SB20260925107 - Use of Uninitialized Variable in Linux kernel clk eswin driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use of Uninitialized Variable (CVE-ID: CVE-2026-93263)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of an uninitialized variable in the eswin_clk_register_pll() and eswin_register_clkdiv() clock-registration helpers when registering PLL and divider clocks. A local user can trigger the affected clock-registration paths to cause a denial of service.

The issue was observed on EIC7700 hardware, and triggering depends on the contents of stack memory when the registration helpers run.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/011d8de504bc84402aabc1dda1cf0552fe9a5af2
• https://git.kernel.org/stable/c/1183dc2450a268a536a15da8b106ec520cdbd19f