CVE-2026-93265 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node
DSP3 has an integrated Ethernet MAC Endpoint which has its own set of config registers for configuring settings such as ASPM. The Endpoint device has two physical functions and those two functions share the same settings.
Parse the Endpoint node under DSP3 instead of parsing both functions. The existing parsing logic also has one OOB issue as parsing both functions will result in accessing past the tc9563_pwrctrl->cfg array.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel vulnerability identified within the PCI power control subsystem for the Toshiba TC9563 bridge device involves a critical memory safety flaw rooted in incorrect node parsing logic during driver initialization. The hardware architecture of this specific Device Service Platform, referred to as DSP3, includes an integrated Ethernet MAC Endpoint equipped with its own configuration registers that manage advanced features such as Active State Power Management or ASPM. This endpoint is exposed through two physical functions within the PCI hierarchy, and these functions share identical configuration settings rather than maintaining independent states for each function instance. The existing driver implementation incorrectly attempted to parse both of these physical functions individually when initializing the power control context, leading to a fundamental misunderstanding of how the hardware resources are mapped in the device tree structure.
This architectural misinterpretation directly results in an out-of-bounds memory access vulnerability. By iterating over and parsing both physical functions separately, the driver logic attempts to write configuration data into an array designated as tc9563_pwrctrl->cfg beyond its allocated boundaries. Since the two functions share the same underlying settings, processing them individually causes redundant writes that exceed the size of the static or dynamically allocated buffer intended for storing these configurations. This out-of-bounds access constitutes a classic memory corruption issue where subsequent reads or writes to adjacent memory locations can corrupt kernel data structures, potentially leading to system instability, unpredictable behavior, or privilege escalation if an attacker can influence the contents of the overwritten memory regions through other vectors.
From a classification perspective, this flaw aligns with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write depending on whether the parsing logic primarily reads configuration values beyond bounds or writes them incorrectly. In terms of attack surface and exploitation potential, such memory corruption issues are often associated with ATT&CK technique T1059 Command and Scripting Interpreter if leveraged via kernel modules, but more directly relate to privilege escalation paths described in techniques like T1068 Exploitation for Privilege Escalation. The vulnerability exists within the core kernel subsystems responsible for hardware abstraction layers, meaning it affects the integrity of the operating system's interaction with physical PCI devices rather than just a user-space application.
The operational impact of this vulnerability is significant because it compromises the stability and security of systems utilizing the TC9563 bridge chip. An out-of-bounds access in kernel space can lead to immediate kernel panics or crashes, resulting in denial of service for any workloads running on that system. Furthermore, if the overwritten memory contains sensitive pointers or control flags used by other kernel subsystems, it could allow a local attacker with limited privileges to execute arbitrary code with root-level permissions. This is particularly dangerous in multi-tenant environments where isolation between virtual machines or containers relies heavily on the integrity of underlying hardware drivers and their correct interaction with device tree configurations.
To mitigate this vulnerability, the resolution involves correcting the parsing logic within the tc9563 power control driver to target only the integrated Ethernet MAC Endpoint node itself rather than iterating through both physical functions. By recognizing that the configuration settings are shared and singular for the endpoint as a whole, the driver should parse the single relevant device tree node associated with the DSP3's Ethernet capabilities. This ensures that writes to the tc9563_pwrctrl->cfg array remain within its allocated bounds. System administrators and developers must apply this kernel patch immediately upon availability. Additionally, enforcing strict memory safety checks during development and utilizing static analysis tools capable of detecting out-of-bounds accesses in device tree parsing routines can prevent similar issues from being introduced into the codebase in the future.