CVE-2026-93272

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93272", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T16:02:15.098Z", "datePublished": "2026-09-24T15:52:14.274Z", "dateUpdated": "2026-10-30T12:36:37.528Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:36:37.528Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3\n\nThe changes introduced to handle single power domain platforms have\nswapped the info pointer increment from num_pd_vregs to num_pds, which\nwould shift the info pointer past the end of the array for pronto-v3,\nwhich does not list power domain regulators in vregs.\n\nThis showed up as a difference between GCC- and LLVM-compiled kernels\non SDM632 devices, where only with LLVM one would get the\n\"regulator request with no identifier\" error, because the out-of-bounds\nmemory ended up being zeroed. Fix by skipping the increment when there\nare more power domains than regulators."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/remoteproc/qcom_wcnss.c"], "versions": [{"version": "8d0d4c11cace475f1b07f98ee3d2bd334590e17b", "lessThan": "d5deaa0b6d91b1063055415fc53f75c40c2a077d", "status": "affected", "versionType": "git"}, {"version": "fef1e1487dea81c2b4560e393ba4b0be57e28d01", "lessThan": "7abab59d6c99ba2b8101d6f44ad25159b1510724", "status": "affected", "versionType": "git"}, {"version": "69bb5b3ae348040e385113efba5bdc76396644d0", "lessThan": "e572cbb513cde53d90fb4729cad75056cd647ce3", "status": "affected", "versionType": "git"}, {"version": "65991ea8a6d1e68effdc01d95ebe39f1653f7b71", "lessThan": "2e7e39bb81913feaac463b7add46bafdca06fbde", "status": "affected", "versionType": "git"}, {"version": "65991ea8a6d1e68effdc01d95ebe39f1653f7b71", "lessThan": "bce6b48af3abf7468d12ef4933f21bd8c1d822e9", "status": "affected", "versionType": "git"}, {"version": "65991ea8a6d1e68effdc01d95ebe39f1653f7b71", "lessThan": "3dbc90b9c22ea96e37bf55f6011e63b5123ec668", "status": "affected", "versionType": "git"}, {"version": "654c295f9079d2c7875172142022168e34c4e34e", "status": "affected", "versionType": "git"}, {"version": "04a89c98810d2dba8187120c07fdb732aa40ca14", "status": "affected", "versionType": "git"}, {"version": "6.1.141", "lessThan": "6.1.191", "status": "affected", "versionType": "semver"}, {"version": "6.6.93", "lessThan": "6.6.160", "status": "affected", "versionType": "semver"}, {"version": "6.12.31", "lessThan": "6.12.114", "status": "affected", "versionType": "semver"}, {"version": "5.15.185", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.14.9", "lessThan": "6.15", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/remoteproc/qcom_wcnss.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.141", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.93", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.31", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.185"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d5deaa0b6d91b1063055415fc53f75c40c2a077d"}, {"url": "https://git.kernel.org/stable/c/7abab59d6c99ba2b8101d6f44ad25159b1510724"}, {"url": "https://git.kernel.org/stable/c/e572cbb513cde53d90fb4729cad75056cd647ce3"}, {"url": "https://git.kernel.org/stable/c/2e7e39bb81913feaac463b7add46bafdca06fbde"}, {"url": "https://git.kernel.org/stable/c/bce6b48af3abf7468d12ef4933f21bd8c1d822e9"}, {"url": "https://git.kernel.org/stable/c/3dbc90b9c22ea96e37bf55f6011e63b5123ec668"}], "title": "remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/remoteproc/qcom_wcnss.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d5deaa0b6d91b1063055415fc53f75c40c2a077d", "status": "affected", "version": "8d0d4c11cace475f1b07f98ee3d2bd334590e17b", "versionType": "git"}, {"lessThan": "7abab59d6c99ba2b8101d6f44ad25159b1510724", "status": "affected", "version": "fef1e1487dea81c2b4560e393ba4b0be57e28d01", "versionType": "git"}, {"lessThan": "e572cbb513cde53d90fb4729cad75056cd647ce3", "status": "affected", "version": "69bb5b3ae348040e385113efba5bdc76396644d0", "versionType": "git"}, {"lessThan": "2e7e39bb81913feaac463b7add46bafdca06fbde", "status": "affected", "version": "65991ea8a6d1e68effdc01d95ebe39f1653f7b71", "versionType": "git"}, {"lessThan": "bce6b48af3abf7468d12ef4933f21bd8c1d822e9", "status": "affected", "version": "65991ea8a6d1e68effdc01d95ebe39f1653f7b71", "versionType": "git"}, {"lessThan": "3dbc90b9c22ea96e37bf55f6011e63b5123ec668", "status": "affected", "version": "65991ea8a6d1e68effdc01d95ebe39f1653f7b71", "versionType": "git"}, {"status": "affected", "version": "654c295f9079d2c7875172142022168e34c4e34e", "versionType": "git"}, {"status": "affected", "version": "04a89c98810d2dba8187120c07fdb732aa40ca14", "versionType": "git"}, {"lessThan": "6.1.191", "status": "affected", "version": "6.1.141", "versionType": "semver"}, {"lessThan": "6.6.160", "status": "affected", "version": "6.6.93", "versionType": "semver"}, {"lessThan": "6.12.114", "status": "affected", "version": "6.12.31", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.185", "versionType": "semver"}, {"lessThan": "6.15", "status": "affected", "version": "6.14.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/remoteproc/qcom_wcnss.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3\n\nThe changes introduced to handle single power domain platforms have\nswapped the info pointer increment from num_pd_vregs to num_pds, which\nwould shift the info pointer past the end of the array for pronto-v3,\nwhich does not list power domain regulators in vregs.\n\nThis showed up as a difference between GCC- and LLVM-compiled kernels\non SDM632 devices, where only with LLVM one would get the\n\"regulator request with no identifier\" error, because the out-of-bounds\nmemory ended up being zeroed. Fix by skipping the increment when there\nare more power domains than regulators."}], "id": "CVE-2026-93272", "lastModified": "2026-10-30T13:21:01.840", "metrics": {}, "published": "2026-09-24T16:17:24.280", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e7e39bb81913feaac463b7add46bafdca06fbde"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3dbc90b9c22ea96e37bf55f6011e63b5123ec668"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7abab59d6c99ba2b8101d6f44ad25159b1510724"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bce6b48af3abf7468d12ef4933f21bd8c1d822e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d5deaa0b6d91b1063055415fc53f75c40c2a077d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e572cbb513cde53d90fb4729cad75056cd647ce3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3", "id": "2540303", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540303"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nremoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3\nThe changes introduced to handle single power domain platforms have\nswapped the info pointer increment from num_pd_vregs to num_pds, which\nwould shift the info pointer past the end of the array for pronto-v3,\nwhich does not list power domain regulators in vregs.\nThis showed up as a difference between GCC- and LLVM-compiled kernels\non SDM632 devices, where only with LLVM one would get the\n\"regulator request with no identifier\" error, because the out-of-bounds\nmemory ended up being zeroed. Fix by skipping the increment when there\nare more power domains than regulators.", "A flaw was found in the Linux kernel's Qualcomm Wireless Connectivity Subsystem (WCNSS) remoteproc driver. When initializing hardware configurations that lack power domain regulators, an incorrect pointer calculation shifts past the bounds of the regulator array. A local privileged user could trigger this flaw during device setup to cause an out-of-bounds memory read, potentially resulting in a system crash and Denial of Service (DoS)."], "name": "CVE-2026-93272", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93272\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93272\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93272.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65991ea8a6d1e68effdc01d95ebe39f1653f7b71,bce6b48af3abf7468d12ef4933f21bd8c1d822e9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65991ea8a6d1e68effdc01d95ebe39f1653f7b71,3dbc90b9c22ea96e37bf55f6011e63b5123ec668)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[654c295f9079d2c7875172142022168e34c4e34e,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8d0d4c11cace475f1b07f98ee3d2bd334590e17b,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fef1e1487dea81c2b4560e393ba4b0be57e28d01,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[69bb5b3ae348040e385113efba5bdc76396644d0,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04a89c98810d2dba8187120c07fdb732aa40ca14,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.185,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.141,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.93,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.31,6.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.14.9,6.15)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.6,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T05:00:09.769008+00:00", "updated": "2026-10-01T21:15:09.066428+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}