In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 The… (CVE-2026-99020)
Description
A vulnerability in the Linux kernel's TPS6594 regulator driver was resolved involving an out-of-bounds array access due to an incorrect count of linear voltage ranges. The issue affects the TPS65224 BUCK2, BUCK3, and BUCK4 descriptors, as well as TPS652G1, where the code reads beyond the defined array when checking voltage selectors. This could cause improper handling of voltage constraints during regulator registration.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's tps6594-regulator driver had a vulnerability where the n_linear_ranges parameter was incorrectly set to 4 for TPS65224 BUCK2-4 descriptors, but the corresponding array tps65224_bucks_2_3_4_ranges[] only contained two entries. The linear range helper functions looped over 4 entries, causing out-of-bounds reads past the array end and misinterpretation of memory as additional ranges. This occurs during normal registration when voltage constraints are checked. The same issue affects TPS652G1 descriptors. The fix involved using ARRAY_SIZE() to ensure the count matches the actual table size, preventing out-of-bounds access.
Potential Impact
The out-of-bounds read could lead to incorrect voltage constraint handling in the regulator driver, potentially causing instability or incorrect voltage regulation. No information about exploitation or broader impact is provided.
Mitigation Recommendations
A fix is available that corrects the n_linear_ranges count by using ARRAY_SIZE() to match the actual array size, preventing out-of-bounds access. Users should apply the updated Linux kernel version containing this fix when available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-69fg-p93r-fpj4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-99020"]
Threat ID: 6adbaacfd73cc49347b2053e
Added to database: 10/23/2026, 18:43:27 UTC
Last enriched: 10/23/2026, 18:54:20 UTC
Last updated: 10/23/2026, 23:45:08 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.