CVE-2026-93213: of: fix out-of-bounds read in of_alias_scan() stem parser
Published Sep 24, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
of: fix out-of-bounds read in ofaliasscan() stem parser
The stem parser tests isdigit((end - 1)) before checking end > start and so reads one byte before the property name when the name is empty or all digits. Check the bound first.
Affected Software
1 affected component
Linux Linux kernel
Event History
Sep 24, 2026
CVE Published
via MITRE·03:10 PM
Data Sourced
via MITRE·03:10 PM
Description
Data Sourced
via NVD·04:17 PM
Description
Frequently Asked Questions
1
What condition triggers the out-of-bounds read?
The issue is triggered while parsing a property name that is empty or consists entirely of digits. In that case, the parser evaluates the byte immediately before the start of the name before confirming that the parsing position remains within bounds.
2
What is the immediate mitigation if the fix cannot be applied?
The provided data does not specify a configuration workaround or mitigation. Apply a kernel version containing the corrected bounds-check ordering when available.