CVE-2026-93067: Linux kernel · drm/bridge: tc358767: clamp the reported AUX read size to the request
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in ec6444a00c49e6c2b5e9a507272a28126677f9ee : update Linux kernel when convenient.
Data as of 26 Oct 2026, 14:49 UTC
Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in ec6444a00c49e6c2b5e9a507272a28126677f9ee, ebf00c51c9ac9188e2806a2b842418805ee879be, dd6274706bec30d005bff0587a4262d01dc2775a +5
Exploitation evidence
Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in the Linux kernel. Users should update to a kernel version that includes the fix identified by the commits listed in establishedFacts.fixedVersions. No additional mitigation is required as the vulnerability is addressed by clamping the reported AUX read size to the requested size.
Description
CVE-2026-93067 is a vulnerability in the Linux kernel's drm/bridge driver for the tc358767 device. The flaw involves improper clamping of the AUX read size, where the controller can report a byte count larger than the requested size, leading to a potential buffer overrun in a 16-byte stack buffer. This issue is considered defense in depth since the controller should not report more bytes than requested. The vulnerability has been fixed by clamping the reported AUX read size back to the requested size.
References
- git.kernel.org/stable/c/ebf00c51c9ac9188e2806a2b842418805ee879be (opens in a new tab)
- git.kernel.org/stable/c/424b762cc26d512e3e7421e57e41b4b55be2400b (opens in a new tab)
- git.kernel.org/stable/c/dd6274706bec30d005bff0587a4262d01dc2775a (opens in a new tab)
- git.kernel.org/stable/c/982caa744fce79d18f2920382aaeb0da821a6e73 (opens in a new tab)
- git.kernel.org/stable/c/33c0b072e31dee98a754d9bd01800359dfeb9e8f (opens in a new tab)
- git.kernel.org/stable/c/57c567e0e8aa76f6e3e8f39d7f40c20bc37e76af (opens in a new tab)
- git.kernel.org/stable/c/9ff718df547372d70ca20ad8e66a3fb1300936b2 (opens in a new tab)
- git.kernel.org/stable/c/ec6444a00c49e6c2b5e9a507272a28126677f9ee (opens in a new tab)