CVE-2026-93213 of: fix out-of-bounds read in of_alias_scan() stem parser
An out-of-bounds read in the Linux kernel's device tree alias parser allows local attackers to cause a crash or leak memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93213?
CVE-2026-93213 is a memory corruption vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
of: fix out-of-bounds read in of_alias_scan() stem parser
The stem parser tests isdigit(*(end - 1)) before checking end > start and so reads one byte before the property name when the name is empty or all digits. Check the bound first.
Which versions are affected by CVE-2026-93213?
How do I fix CVE-2026-93213?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-93213 being exploited?
There is no known exploitation of CVE-2026-93213 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-93213, DEBIAN-CVE-2026-93213, GHSA-cjjg-5mgv-fpg3, UBUNTU-CVE-2026-93213.