CVE-2026-93119: Linux kernel · usb: ljca: bound bank_num in ljca_enumerate_gpio()
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in dd9483726d0f16c1a56879c3edb65128259a4e2b : patch Linux kernel soon.
Data as of 26 Oct 2026, 17:16 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in dd9483726d0f16c1a56879c3edb65128259a4e2b, aed958c4f784a29cf42abb3e54af51a16bddde46, 0069593170a3d177de793c9a0b36989c4f069111 +1
Exploitation evidence
Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to dd9483726d0f16c1a56879c3edb65128259a4e2b, aed958c4f784a29cf42abb3e54af51a16bddde46, 0069593170a3d177de793c9a0b36989c4f069111 or 9c4bc8f7426aa001387800bf0140bfc5087a6de3.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
The vulnerability has been fixed in Linux kernel commits dd9483726d0f16c1a56879c3edb65128259a4e2b, aed958c4f784a29cf42abb3e54af51a16bddde46, 0069593170a3d177de793c9a0b36989c4f069111, and 9c4bc8f7426aa001387800bf0140bfc5087a6de3. Users and administrators should update to a Linux kernel version including these fixes. No additional mitigation is required if the fix is applied.
Description
A stack overflow vulnerability exists in the Linux kernel's USB LJCA driver due to improper bounds checking of the bank_num parameter in ljca_enumerate_gpio(). This can allow a malicious or broken LJCA device to cause a stack overflow by reporting a bank_num value that exceeds the size of the valid_pin[] array.
References
- git.kernel.org/stable/c/0069593170a3d177de793c9a0b36989c4f069111 (opens in a new tab)
- git.kernel.org/stable/c/aed958c4f784a29cf42abb3e54af51a16bddde46 (opens in a new tab)
- git.kernel.org/stable/c/9c4bc8f7426aa001387800bf0140bfc5087a6de3 (opens in a new tab)
- git.kernel.org/stable/c/dd9483726d0f16c1a56879c3edb65128259a4e2b (opens in a new tab)