Look up another CVE · open CVE-2026-93046 in the interactive tracker
CVE-2026-93046
software node: Fix software_node_get_reference_args() with index -1
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem drivers/base. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-93046 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The bounds check for the index passed to software_node_get_reference_args() was failing when passed UINT_MAX, this in turn would lead to an out of bound access in the property array. Fix the bound check to also cover the UINT_MAX case.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/base/swnode.c
- What this is
- SOFTWARE NODES AND DEVICE PROPERTIESMAINTAINERS section matched on drivers/base/swnode.c · linux-acpi@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12y
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.0 high
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 3.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/base
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.10.239 | 5.10.270 | 6cde06887487 |
| 5.15.186 | 5.15.221 | 0631384eadeb |
| 6.1.142 | 6.1.188 | b2fa4e8c7e4a |
| 6.6.95 | 6.6.157 | 4ebf96d5f834 |
| 6.12.35 | 6.12.110 | 849076df1512 |
| 6.16 | 6.18.52 | df5466412b36 |
| 6.16 | 7.2.6 | 231bbc04c58f |
| 6.16 | 7.3 | ba3dedcf3bd4 |
| 6.15.4 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The OOB is in software_node_get_reference_args() in drivers/base/swnode.c, reached only from in-kernel fwnode_property_get_reference_args()/fwnode_find_reference() on local probe/consumer paths (led_get → fwnode_led_get, swnode_gpio_get_reference, IIO/reset/mailbox); the wrapping index is a kernel argument, not bytes from a packet or remote peer.
- AC:HAttack complexity, high
- Only index==UINT_MAX makes (index+1)*sizeof(*ref) wrap to 0 so the bound is skipped. led_get() passes -1 into fwnode_led_get(), but that value is overwritten by fwnode_property_match_string() for every in-tree con_id (v4l2_subdev_get_privacy_led "privacy", yogabook "pen-icon-led"); other negative errnos do not wrap on 64-bit, so the attacker cannot force UINT_MAX against a live DEV_PROP_REF.
- PR:LPrivileges required, low
- The lookup runs in driver probe and consumer helpers (led_get from v4l2_subdev_get_privacy_led, swnode_find_gpio, fwnode_find_reference) with no capability check; an unprivileged local user can provoke those paths by opening a consumer device node or causing bind, without init-namespace root or user-namespace tricks.
- UI:NUser interaction, none
- software_node_get_reference_args() runs automatically inside fwnode_find_reference()/led_get()/swnode_gpio_get_reference during probe or consumer get; no other user must mount media, open a file, or confirm a prompt.
- S:UScope, unchanged
- The wild software_node_ref_args load, fwnode_handle_get() and any oops stay inside the host kernel; no VM, IOMMU or sandbox boundary is crossed.
- C:HConfidentiality impact, high
- ref=&ref_array[UINT_MAX] reads a full software_node_ref_args (swnode, fwnode, nargs, args[NR_FWNODE_REFERENCE_ARGS]) from wrapped/wild memory; those pointers and u64 args[] are not a few bounded bytes and can be returned to GPIO/LED/IIO consumers.
- I:HIntegrity impact, high
- The OOB bytes are used as ref->swnode/ref->fwnode; software_node_fwnode() or fwnode_handle_get() then software_node_get() → kobject_get() runs on that pointer, an ops-vtable call and a refcount write at a non-object address — a control-flow-relevant primitive.
- A:HAvailability impact, high
- The wrapped ref_array[UINT_MAX] pointer is immediately dereferenced (ref->swnode / ref->fwnode / fwnode_handle_get()), which oopses or panics the kernel (KASAN slab-OOB or wild-pointer fault).