SB20260925109 - Memory corruption in Linux kernel pci pwrctrl driver

Description

This security bulletin contains information about 1 vulnerability.

1) Memory corruption (CVE-ID: CVE-2026-93265)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds array access.

The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in the tc9563 power-control driver's endpoint device-tree parsing logic when parsing the integrated Ethernet MAC Endpoint node under DSP3. A local user can cause the driver to parse both physical functions as separate endpoint devices to cause an out-of-bounds array access.

The endpoint has two physical functions that share the same configuration registers.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/6e5e6c2194b2acbded5b12ed80590d215b786d29
• https://git.kernel.org/stable/c/972c771674e88a43c8310c459ea30f0f0d0c168f