CVE-2026-99020: Linux kernel · regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f3423b56be12208a393274afb9a5e3d67fc58ce3 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 17:16 UTC
Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in f3423b56be12208a393274afb9a5e3d67fc58ce3, f6fbe9c6b39968a7696b9badef4bc29331a6376a, 66b7da589b2ce44a02b8387c6160e9254685f34f +3
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
Update affected Linux kernel versions to 6.6.160 or later, or apply the patch that corrects the n_linear_ranges count to use ARRAY_SIZE(). No other mitigation is indicated or required.
Description
A vulnerability in the Linux kernel's TPS65224 regulator driver caused out-of-bounds array access due to incorrect linear range count for BUCK2-4 descriptors. This flaw could lead to reading invalid memory during voltage constraint checks. The issue affects Linux kernel versions >=6.6.157 <6.6.160 and version 6.10. It has been fixed by correcting the count to match the actual array size.
References
- git.kernel.org/stable/c/1ea151615a82fd94f25e38b2cc7eeac49112508b (opens in a new tab)
- git.kernel.org/stable/c/66b7da589b2ce44a02b8387c6160e9254685f34f (opens in a new tab)
- git.kernel.org/stable/c/f6fbe9c6b39968a7696b9badef4bc29331a6376a (opens in a new tab)
- git.kernel.org/stable/c/f3423b56be12208a393274afb9a5e3d67fc58ce3 (opens in a new tab)
- git.kernel.org/stable/c/2f15518682c779b1014552cb2ccb4a2052f85f27 (opens in a new tab)