CVE-2026-46293 clk: microchip: mpfs-ccc: fix out of bounds access during output registration
Out-of-bounds memory access in the Microchip PolarFire SoC clock driver can lead to system crashes or potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46293?
CVE-2026-46293 is a high-severity memory corruption vulnerability in Linux kernel, published on 8 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
clk: microchip: mpfs-ccc: fix out of bounds access during output registration
UBSAN reported an out of bounds access during registration of the last two outputs. This out of bounds access occurs because space is only allocated in the hws array for two PLLs and the four output dividers that each has, but the defined IDs contain two DLLS and their two outputs each, which are not supported by the driver. The ID order is PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs by two while adding them to the array to avoid the problem.
Weakness: CWE-125
Which versions are affected by CVE-2026-46293?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46293?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-46293 being exploited?
There is no known exploitation of CVE-2026-46293 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-46293, DEBIAN-CVE-2026-46293, GHSA-hjvh-379x-4g57, ROOT-OS-DEBIAN-12-CVE-2026-46293, UBUNTU-CVE-2026-46293.