HIGH
swnode ReferenceArgs OOB
CVE-2026-93046
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: software node: Fix software_node_get_reference_args() with index -1 The bounds check for the index passed to software_node_get_reference_args() was failing when passed UINT_MAX, this in turn would lead to an out of bound access in the property array. Fix the bound check to also cover the UINT_MAX case.
02KernelScan AI Analysis
Risk summary
A bounds-check flaw in the kernel's software node framework allows an unsigned-integer-overflow to bypass array index validation, leading to an out-of-bounds read that will almost certainly crash the kernel. The bug is reachable through local driver code paths that pass a large index to the firmware node reference-argument API. Devices with local user access or shared kernels face the greatest risk of denial of service.
Vulnerability analysis
A bounds check in the kernel's software-node framework can be bypassed by passing the maximum unsigned integer as an array index. Adding one to that value wraps around to zero, so the size comparison mistakenly passes. This leads to an out-of-bounds read at a huge offset, which will almost certainly hit unmapped memory and crash the kernel. The fix changes the check to compare the index directly against the number of array elements, avoiding the overflow entirely. The bug is reached through local driver code paths that pass a large or unchecked index to the framework.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.10.239 | 5.10.270 | 6cde06887487 |
| 5.15 | 5.15.186 | 5.15.221 | 0631384eadeb |
| 6.1 | 6.1.142 | 6.1.188 | b2fa4e8c7e4a |
| 6.12 | 6.12.35 | 6.12.110 | 849076df1512 |
| 6.15 | 6.15.4 | 6.16 | df5466412b36 |
| 6.18 | — | 6.18.52 | 231bbc04c58f |
| 6.6 | 6.6.95 | 6.6.157 | 4ebf96d5f834 |
| 7.2 | — | 7.2.6 | ba3dedcf3bd4 |
| mainline | — | 7.3 | — |
| cip/5.10 | — | 5.10.271-cip78 | 6cde06887487 |
| cip/6.1 | — | 6.1.189-cip61 | b2fa4e8c7e4a |
| cip/6.1-rt | — | 6.1.189-cip61-rt32 | b2fa4e8c7e4a |
| cip/6.12 | — | 6.12.111-cip32 | 849076df1512 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |