« Volver al listado

CVE-2026-93266

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

arm64: RSI: fix field-spanning write warning in attestation token init

The challenge is passed in registers a1 through a8. However, copying to &regs.a1 makes FORTIFY treat the destination as the single a1 field, resulting in a field-spanning write warning. [1]

Overlay the SMCCC register structure with an RSI-specific argument layout and copy the challenge into an explicit 64-byte array. This keeps the existing a1-a8 argument encoding while giving the copy a correctly sized destination object.

[1] memcpy: detected field-spanning write (size 64) of single field "&regs.a1" at ./arch/arm64/include/asm/rsi_cmds.h:119 (size 8) WARNING: ./arch/arm64/include/asm/rsi_cmds.h:119 at rsi_attestation_token_init+0xdc/0xf8 [arm_cca_guest], CPU#0: cat/3314

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93266",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b880a80011f56880f32bde47fc6af313359f926b",
              "lessThan": "e505092cb200d430d5b8d8d3e926d45f29474ba3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b880a80011f56880f32bde47fc6af313359f926b",
              "lessThan": "d29a8ee271da17b5e32d7a76a9c78d43f66447ca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b880a80011f56880f32bde47fc6af313359f926b",
              "lessThan": "221049874b6a78c7d87bc826581b0695cd338e2b",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/arm64/include/asm/rsi_cmds.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.13",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/arm64/include/asm/rsi_cmds.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-24T16:17:23.453",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/221049874b6a78c7d87bc826581b0695cd338e2b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d29a8ee271da17b5e32d7a76a9c78d43f66447ca",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e505092cb200d430d5b8d8d3e926d45f29474ba3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: RSI: fix field-spanning write warning in attestation token init\n\nThe challenge is passed in registers a1 through a8. However, copying to\n&regs.a1 makes FORTIFY treat the destination as the single a1 field,\nresulting in a field-spanning write warning. [1]\n\nOverlay the SMCCC register structure with an RSI-specific argument\nlayout and copy the challenge into an explicit 64-byte array. This keeps\nthe existing a1-a8 argument encoding while giving the copy a correctly\nsized destination object.\n\n[1]\nmemcpy: detected field-spanning write (size 64) of single field \"&regs.a1\" at ./arch/arm64/include/asm/rsi_cmds.h:119 (size 8)\nWARNING: ./arch/arm64/include/asm/rsi_cmds.h:119 at rsi_attestation_token_init+0xdc/0xf8 [arm_cca_guest], CPU#0: cat/3314"
    }
  ],
  "lastModified": "2026-09-24T16:17:23.453",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}