HIGH Introduced in 6.19
pci-pwrctrl DSP3 OOB
CVE-2026-93265
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node DSP3 has an integrated Ethernet MAC Endpoint which has its own set of config registers for configuring settings such as ASPM. The Endpoint device has two physical functions and those two functions share the same settings. Parse the Endpoint node under DSP3 instead of parsing both functions. The existing parsing logic also has one OOB issue as parsing both functions will result in accessing past the tc9563_pwrctrl->cfg array.
02KernelScan AI Analysis
Risk summary
A local out-of-bounds write in the TC9563 PCIe power control driver affects any system with the TC9563 PCIe switch hardware. The bug triggers automatically at driver probe time during boot, but exploitation requires an attacker to first modify the device tree via root access or physical bootloader access. The resulting kernel memory corruption can lead to information disclosure, data integrity loss, or a system crash.
Vulnerability analysis
The TC9563 power-control driver reads the device-tree description of the PCIe switch when it starts up. It used to walk every child node under the third downstream port and use an increasing index to store configuration values in a fixed-size array. Because that port's integrated Ethernet endpoint is a single device, advancing the index for each child writes past the end of the array. The corrected code looks for one specific endpoint node and stores its settings at a predetermined safe offset instead. The flaw is reached during boot while the driver is initializing the hardware, so an attacker who can alter the device tree—through root access or physical bootloader access—can trigger the out-of-bounds write when the system boots.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.19 | 7.2.6 | 972c771674e8 |
| mainline | 6.19 | 7.3 | 6e5e6c2194b2 |