CVE-2026-93213 - Vulnerability Details

- of: fix out-of-bounds read in of_alias_scan() stem parser

Description

In the Linux kernel, the following vulnerability has been resolved:

of: fix out-of-bounds read in of_alias_scan() stem parser

The stem parser tests isdigit(*(end - 1)) before checking end > start
and so reads one byte before the property name when the name is empty
or all digits. Check the bound first.

Published: 2026-09-24

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`611cad720148c899db5a383c1c676fd820df7023`	affected	< fd0c7bbda81c0e0c1cb7b68d267b87371584f560
`611cad720148c899db5a383c1c676fd820df7023`	affected	< 958d7ee9fcf008ef9d2072c6410ee1bf6abf3b64
`611cad720148c899db5a383c1c676fd820df7023`	affected	< f7f6c3e32a31f2e1ed12075e8cd22b370a84e67a
`611cad720148c899db5a383c1c676fd820df7023`	affected	< da7a80ddc610a19b0378016a4d816b9355f013a7
`611cad720148c899db5a383c1c676fd820df7023`	affected	< 96a9c984dd7c3589a2707a32b62802f98311dbfd
`611cad720148c899db5a383c1c676fd820df7023`	affected	< 9253cfc5a85be1494ce56b4fc6f2d2b509440910
`611cad720148c899db5a383c1c676fd820df7023`	affected	< acd1b49043366f43e932308b4db7d3ce568eeadb
`611cad720148c899db5a383c1c676fd820df7023`	affected	< 5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f

Linux

affected

Version	Status	Constraints
`3.2`	affected	—
`0`	unaffected	< 3.2
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[611cad720148c899db5a383c1c676fd820df7023,fd0c7bbda81c0e0c1cb7b68d267b87371584f560)`	affected	code_commit	—
`[611cad720148c899db5a383c1c676fd820df7023,958d7ee9fcf008ef9d2072c6410ee1bf6abf3b64)`	affected	code_commit	—
`[611cad720148c899db5a383c1c676fd820df7023,f7f6c3e32a31f2e1ed12075e8cd22b370a84e67a)`	affected	code_commit	—
`[611cad720148c899db5a383c1c676fd820df7023,da7a80ddc610a19b0378016a4d816b9355f013a7)`	affected	code_commit	—
`[611cad720148c899db5a383c1c676fd820df7023,96a9c984dd7c3589a2707a32b62802f98311dbfd)`	affected	code_commit	—
`[611cad720148c899db5a383c1c676fd820df7023,9253cfc5a85be1494ce56b4fc6f2d2b509440910)`	affected	code_commit	—
`[611cad720148c899db5a383c1c676fd820df7023,acd1b49043366f43e932308b4db7d3ce568eeadb)`	affected	code_commit	—
`[611cad720148c899db5a383c1c676fd820df7023,5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.2`	affected	generic	—
`[0,3.2)`	unaffected	generic	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f
https://git.kernel.org/stable/c/9253cfc5a85be1494ce56b4fc6f2d2b509440910
https://git.kernel.org/stable/c/958d7ee9fcf008ef9d2072c6410ee1bf6abf3b64
https://git.kernel.org/stable/c/96a9c984dd7c3589a2707a32b62802f98311dbfd
https://git.kernel.org/stable/c/acd1b49043366f43e932308b4db7d3ce568eeadb
https://git.kernel.org/stable/c/da7a80ddc610a19b0378016a4d816b9355f013a7
https://git.kernel.org/stable/c/f7f6c3e32a31f2e1ed12075e8cd22b370a84e67a
https://git.kernel.org/stable/c/fd0c7bbda81c0e0c1cb7b68d267b87371584f560

History

Sat, 26 Sep 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Thu, 24 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: of: fix out-of-bounds read in of_alias_scan() stem parser The stem parser tests isdigit(*(end - 1)) before checking end > start and so reads one byte before the property name when the name is empty or all digits. Check the bound first.
Title		of: fix out-of-bounds read in of_alias_scan() stem parser
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f https://git.kernel.org/stable/c/9253cfc5a85be1494ce56b4fc6f2d2b509440910 https://git.kernel.org/stable/c/958d7ee9fcf008ef9d2072c6410ee1bf6abf3b64 https://git.kernel.org/stable/c/96a9c984dd7c3589a2707a32b62802f98311dbfd https://git.kernel.org/stable/c/acd1b49043366f43e932308b4db7d3ce568eeadb https://git.kernel.org/stable/c/da7a80ddc610a19b0378016a4d816b9355f013a7 https://git.kernel.org/stable/c/f7f6c3e32a31f2e1ed12075e8cd22b370a84e67a https://git.kernel.org/stable/c/fd0c7bbda81c0e0c1cb7b68d267b87371584f560

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T15:10:36.166Z

Updated: 2026-09-24T15:10:36.166Z

Reserved: 2026-09-17T16:02:15.093Z

Link: CVE-2026-93213

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T16:17:16.257

Modified: 2026-09-24T16:17:16.257

Link: CVE-2026-93213

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-26T02:15:03Z

Weaknesses

CWE-125

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object