CVE-2026-93265 PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node
A Linux kernel driver flaw allows out-of-bounds memory access, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93265?
CVE-2026-93265 is a high-severity memory corruption vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node
DSP3 has an integrated Ethernet MAC Endpoint which has its own set of config registers for configuring settings such as ASPM. The Endpoint device has two physical functions and those two functions share the same settings.
Parse the Endpoint node under DSP3 instead of parsing both functions. The existing parsing logic also has one OOB issue as parsing both functions will result in accessing past the tc9563_pwrctrl->cfg array.
Which versions are affected by CVE-2026-93265?
How do I fix CVE-2026-93265?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-93265 being exploited?
There is no known exploitation of CVE-2026-93265 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-93265, GHSA-269q-3q6g-mmg8, UBUNTU-CVE-2026-93265.