Kernel compromise via unchecked SBI notification length

Out-of-bounds memory access in the Linux kernel allows attackers to compromise the kernel via malformed SBI MPXY notifications. The mpxy_get_notifications function trusts the SBI return length when copying shared memory into mchan->notif, while the RPMI event walker also accepts truncated headers and payload extents. Exploitation requires compromised SBI MPXY firmware or an RPMI platform controller on a bound RISC-V system; successful abuse can disclose or corrupt kernel memory or panic the host.