---
id: CVE-2026-53294
title: 'mailbox: mailbox-test: don''t free the reused channel'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mailbox: mailbox-test: don't free the reused channel

  The RX channel can be aliased to the TX channel if it has a different
  MMIO. This special case needs to be handled …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 <
    fc0089f82c3e36060c2c79156bc2018bfb16b56b
  - >-
    Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 <
    5d4f3d0f64f1016cb78b400a70b67df91fac99b5
  - >-
    Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 <
    c494a11da45ad7ec9b0ff216c3e3ace351193bb6
  - >-
    Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 <
    3afca89fae501dbd7421e1777b5b8f033b1d98d0
  - >-
    Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 <
    5c209299b0113e289e238fa5f2e8f00c59f76060
  - >-
    Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 <
    82f6dcea46cf5de65c4ba7283f7c7b34de4a324d
  - >-
    Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 <
    240c71a2aea36a1a4210f911a1c32ea88777e8e4
  - >-
    Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 <
    88ebadbf0deefdaccdab868b44ff70a0a257f473
  - Linux 4.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:25:48.586283Z'
published: '2026-06-26'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:18.789Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53294'
references:
  - url: 'https://git.kernel.org/stable/c/fc0089f82c3e36060c2c79156bc2018bfb16b56b'
  - url: 'https://git.kernel.org/stable/c/5d4f3d0f64f1016cb78b400a70b67df91fac99b5'
  - url: 'https://git.kernel.org/stable/c/c494a11da45ad7ec9b0ff216c3e3ace351193bb6'
  - url: 'https://git.kernel.org/stable/c/3afca89fae501dbd7421e1777b5b8f033b1d98d0'
  - url: 'https://git.kernel.org/stable/c/5c209299b0113e289e238fa5f2e8f00c59f76060'
  - url: 'https://git.kernel.org/stable/c/82f6dcea46cf5de65c4ba7283f7c7b34de4a324d'
  - url: 'https://git.kernel.org/stable/c/240c71a2aea36a1a4210f911a1c32ea88777e8e4'
  - url: 'https://git.kernel.org/stable/c/88ebadbf0deefdaccdab868b44ff70a0a257f473'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.0712
ingestedAt: '2026-11-06T16:57:43.254Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mailbox: mailbox-test: don't free the reused channel

The RX channel can be aliased to the TX channel if it has a different
MMIO. This special case needs to be handled when freeing the channels
otherwise a double-free occurs.

## Affected

- `Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 < fc0089f82c3e36060c2c79156bc2018bfb16b56b`
- `Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 < 5d4f3d0f64f1016cb78b400a70b67df91fac99b5`
- `Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 < c494a11da45ad7ec9b0ff216c3e3ace351193bb6`
- `Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 < 3afca89fae501dbd7421e1777b5b8f033b1d98d0`
- `Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 < 5c209299b0113e289e238fa5f2e8f00c59f76060`
- `Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 < 82f6dcea46cf5de65c4ba7283f7c7b34de4a324d`
- `Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 < 240c71a2aea36a1a4210f911a1c32ea88777e8e4`
- `Linux >= 8ea4484d0c2bb4e2152261943fa1a3522654b1c7 < 88ebadbf0deefdaccdab868b44ff70a0a257f473`
- `Linux 4.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.