Linux Kernel CVE-2026-93265

Exploitation requires the physical presence of a Toshiba TC9563 PCIe switch whose DSP3 has an integrated Ethernet MAC Endpoint with two physical functions; the buggy parsing runs during driver initialization/probe. Without this specific hardware the vulnerable code path is never reached, which is the dominant limiting factor. There is no described network path and no attacker-supplied runtime input - the OOB is driven by the device topology parsed by the driver.

This is a genuine memory-corruption bug (out-of-bounds access past the tc9563_pwrctrl->cfg array), but the real-world risk is LOW despite the 7.7 CVSS. The CVSS vector (AV:L/AC:L/PR:N/UI:N/C:N/I:H/A:H) claims local, no-privilege exploitation with high integrity/availability impact, but the flaw lives in the PCI/pwrctrl driver's device-node parsing logic during probe/config - the OOB comes from parsing both physical functions of the DSP3 integrated Ethernet MAC Endpoint rather than the shared Endpoint node. This is triggered by device-tree/config topology, not by an arbitrary local attacker sending input, so PR:N is generous - realistically there is no attacker-controlled path on a general system. EPSS is unavailable, there is no CISA KEV listing, and no public exploit exists. Critically, the vulnerable code only executes on systems with Toshiba TC9563 PCIe switch hardware present, so the exploitable population is a tiny slice of Linux deployments. Conflicting signal to flag: the CVSS says AV:L/PR:N but the mechanism is a hardware-topology parsing bug, not a conventional local privilege path - treat the 7.7 as an upper bound, not a fielded threat.

On a system equipped with a Toshiba TC9563 PCIe switch, the pwrctrl driver parses both physical functions of the DSP3 integrated Ethernet MAC Endpoint instead of the shared Endpoint node, indexing past the end of the tc9563_pwrctrl->cfg array during initialization. This corrupts adjacent kernel memory, most plausibly causing a crash or undefined behavior at probe time. No public exploit code exists and exploitation is bounded to the specific hardware.