CVE-2026-97957

A heap based out of bounds write exists in the HINIC PF mailbox receive path because the segment length validation allows the final mailbox segment to extend beyond the 2048 byte receive buffer. A segment with seq_id 42 can start at offset 2016 and carry 48 bytes, resulting in a write of up to 16 bytes beyond the end of the buffer. A malicious VF may trigger the condition through PF VF mailbox communication. This is relevant when an untrusted guest or tenant controls an assigned virtual function while the vulnerable PF driver runs on the host. For the CVSS the PR:L value is used because reliable triggering requires control of a VF mailbox endpoint, usually through a guest with access to the assigned device or a local process with device administration capability. The guest to host boundary results in Scope Changed. Impact is at least host kernel memory corruption and denial of service. In the worst case the heap overflow may affect confidentiality and integrity or enable privilege escalation, but exploitability depends on allocator layout and the overwritten adjacent object.