CVE-2026-93272remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 The changes introduced to handle single power domain platforms have swapped the info pointer increment from num_pd_vregs to num_pds, which would shift the info pointer past the end of the array for pronto-v3, which does not list power domain regulators in vregs. This showed up as a difference between GCC- and LLVM-compiled kernels on SDM632 devices, where only with LLVM one would get the "regulator request with no identifier" error, because the out-of-bounds memory ended up being zeroed. Fix by skipping the increment when there are more power domains than regulators.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 65991ea8a6d1e68effdc01d95ebe39f1653f7b71 builds before 2e7e39bb81913feaac463b7add46bafdca06fbde; from 65991ea8a6d1e68effdc01d95ebe39f1653f7b71 before bce6b48af3abf7468d12ef4933f21bd8c1d822e9; 65991ea8a6d1e68effdc01d95ebe39f1653f7b71 builds before 3dbc90b9c22ea96e37bf55f6011e63b5123ec668; 654c295f9079d2c7875172142022168e34c4e34e; 8d0d4c11cace475f1b07f98ee3d2bd334590e17b; fef1e1487dea81c2b4560e393ba4b0be57e28d01; 69bb5b3ae348040e385113efba5bdc76396644d0; 04a89c98810d2dba8187120c07fdb732aa40ca14; and 5 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/2e7e39bb81913feaac463b7add46bafdca06fbde
- https://git.kernel.org/stable/c/bce6b48af3abf7468d12ef4933f21bd8c1d822e9
- https://git.kernel.org/stable/c/3dbc90b9c22ea96e37bf55f6011e63b5123ec668
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.