CVE-2026-97957

In the Linux kernel, the following vulnerability has been resolved:

net: hinic: fix mailbox segment buffer overflow

check_mbox_seq_id_and_seg_len() validates that seq_id does not

exceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed

MBOX_SEG_LEN (48). However, this allows the last segment

(seq_id=42) to carry a full 48-byte payload, writing to offset

42*48=2016 for 48 bytes (ending at byte 2064). The receive

buffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a

16-byte heap buffer overflow.

The hinic3 driver already handles this correctly by defining

MBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it

exceeds the remaining buffer space. Apply the same fix to the

hinic driver.