UBUNTU-CVE-2026-93119: Medium severity ubuntu/linux-hwe-edge vulnerability

Q: Which systems are exposed to this issue?

Systems using one of the listed Ubuntu Linux kernel packages are exposed when they interact with an LJCA USB device that supplies crafted or malformed GPIO enumeration data. The issue is in the LJCA USB driver's handling of device-reported GPIO bank information.

Q: What does an attacker or faulty device need to provide to trigger the overflow?

The device must report a bank_num larger than the two entries available in valid_pin[] while still satisfying the existing payload-length and total-GPIO checks. For example, bank_num 9 with pins_per_bank 7 passes those checks and causes nine 32-bit writes into a two-entry stack array.

Q: Are the existing device-response validation checks sufficient?

No. The response-size check and the pins_per_bank multiplied by bank_num check do not ensure that bank_num fits in valid_pin[]. The fix rejects bank_num values that exceed the capacity of that array.

Q: What can be done before an updated kernel is available?

Avoid connecting or trusting broken or untrusted LJCA USB devices, since the vulnerable data is supplied by the device during GPIO enumeration. The provided data does not describe another mitigation.

Published Sep 17, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: usb: ljca: bound banknum in ljcaenumerategpio() ljcaenumerategpio() reads desc->banknum from the device and loops validpin[i] = getunalignedle32(...) for i < banknum. validpin[] holds only LJCAMAXGPIONUM / 32 = 2 entries. Two checks run before the loop. The reply length must match structsize(desc, bankdesc, banknum). The product pinsperbank banknum must not exceed LJCAMAXGPIONUM. Neither one bounds banknum against the size of validpin[]. The reply is capped at LJCAMAXPAYLOADSIZE (60) bytes, so the structsize check limits banknum to 9. A device that reports banknum 9 with pinsperbank 7 still passes both checks. gpionum is 63 and the reply is 56 bytes. The loop then writes nine u32 into the two entry array and overruns validpin[] on the stack. A broken or malicious LJCA device can therefore overflow the stack. Reject a banknum that does not fit validpin[].

Affected Software

161 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm-6.8*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0*

ubuntu/linux-azure*

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0*

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0*

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-42.42~24.04.1

7.0.0-42.42~24.04.1

ubuntu/linux-ibm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0*

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0*

ubuntu/linux-raspi*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-42.42.1~24.04.1

7.0.0-42.42.1~24.04.1

ubuntu/linux-xilinx*

ubuntu/linux-bluefield*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<7.0.0-42.42

7.0.0-42.42

ubuntu/linux-aws<7.0.0-1016.17

7.0.0-1016.17

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<7.0.0-1016.18

7.0.0-1016.18

ubuntu/linux-gke*

ubuntu/linux-ibm<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-bos*

ubuntu/linux-oem-7.0<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-oracle<7.0.0-1015.16

7.0.0-1015.16

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv<7.0.0-42.42.1

7.0.0-42.42.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42.1~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.17
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.18
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.16
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42.1
Compensating control
In ljca_enumerate_gpio(), reject a device-reported bank_num that does not fit valid_pin[] and reject any pins_per_bank * bank_num value exceeding LJCA_MAX_GPIO_NUM; also require the reply length to match struct_size(desc, bank_desc, bank_num) before iterating over valid_pin[].

Event History

Sep 17, 2026

CVE Published

via OSV·05:18 PM

Data Sourced

via OSV·05:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using one of the listed Ubuntu Linux kernel packages are exposed when they interact with an LJCA USB device that supplies crafted or malformed GPIO enumeration data. The issue is in the LJCA USB driver's handling of device-reported GPIO bank information.

What does an attacker or faulty device need to provide to trigger the overflow?

The device must report a bank_num larger than the two entries available in valid_pin[] while still satisfying the existing payload-length and total-GPIO checks. For example, bank_num 9 with pins_per_bank 7 passes those checks and causes nine 32-bit writes into a two-entry stack array.

Are the existing device-response validation checks sufficient?

No. The response-size check and the pins_per_bank multiplied by bank_num check do not ensure that bank_num fits in valid_pin[]. The fix rejects bank_num values that exceed the capacity of that array.

What can be done before an updated kernel is available?

Avoid connecting or trusting broken or untrusted LJCA USB devices, since the vulnerable data is supplied by the device during GPIO enumeration. The provided data does not describe another mitigation.

UBUNTU-CVE-2026-93119: Medium severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker or faulty device need to provide to trigger the overflow?

Are the existing device-response validation checks sufficient?

What can be done before an updated kernel is available?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker or faulty device need to provide to trigger the overflow?

Are the existing device-response validation checks sufficient?

What can be done before an updated kernel is available?