CVE-2026-93272
Received Received - Intake

remoteproc: qcom_wcnss Power Domain Handling Flaw

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 The changes introduced to handle single power domain platforms have swapped the info pointer increment from num_pd_vregs to num_pds, which would shift the info pointer past the end of the array for pronto-v3, which does not list power domain regulators in vregs. This showed up as a difference between GCC- and LLVM-compiled kernels on SDM632 devices, where only with LLVM one would get the "regulator request with no identifier" error, because the out-of-bounds memory ended up being zeroed. Fix by skipping the increment when there are more power domains than regulators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93272
EUVD
EUVD-2026-86144

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of power domain regulators in the Qualcomm WCNSS remote processor driver for pronto-v3 platforms. The code mistakenly increments an info pointer based on the number of power domains instead of power domain regulators, causing it to access memory beyond the allocated array. This leads to a potential out-of-bounds error.

Detection Guidance

This vulnerability is specific to the Linux kernel's remoteproc subsystem for Qualcomm WCNSS devices. Detection requires checking kernel logs for errors related to regulator requests or power domain handling in the remoteproc module. Look for messages like 'regulator request with no identifier' in system logs.

Impact Analysis

This vulnerability may cause kernel errors such as 'regulator request with no identifier' on affected devices like SDM632 when compiled with LLVM. It could lead to system instability, crashes, or unexpected behavior in systems using the Qualcomm WCNSS remote processor.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to power domain handling in the Linux remoteproc subsystem. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the kernel patch that fixes the handling of power domains in the qcom_wcnss driver. Update to a kernel version that includes the fix for CVE-2026-93272. Monitor kernel logs after applying the patch to ensure the issue is resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart