CVE-2026-93272: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: qcomwcnss: Fix handling the lack of PD regulators in v3
The changes introduced to handle single power domain platforms have swapped the info pointer increment from numpdvregs to numpds, which would shift the info pointer past the end of the array for pronto-v3, which does not list power domain regulators in vregs.
This showed up as a difference between GCC- and LLVM-compiled kernels on SDM632 devices, where only with LLVM one would get the "regulator request with no identifier" error, because the out-of-bounds memory ended up being zeroed. Fix by skipping the increment when there are more power domains than regulators.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by the faulty array traversal?
The issue applies to pronto-v3 configurations that have more power domains than power-domain regulators, because pronto-v3 does not list power-domain regulators in its vregs array. It was observed on SDM632 devices.
How can I identify this problem in logs?
On an LLVM-compiled kernel, the issue may present as a "regulator request with no identifier" error. The same out-of-bounds access did not produce that error in the reported GCC-built kernel case because the relevant memory layout differed.
What is the required corrective change?
The power-domain regulator information pointer must not be incremented when the number of power domains exceeds the number of regulators. The referenced stable commits contain the resolved fix.