Skip to main content

Linux Kernel EUVDEUVD-2026-35159

| CVE-2026-46293 HIGH
Out-of-bounds Read (CWE-125)
2026-06-08 Linux GHSA-hjvh-379x-4g57
Buffer Overflow Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Local access to PolarFire SoC Linux host
  2. Delivery
    mpfs-ccc driver registers clock outputs
  3. Exploit
    ID/array-size mismatch indexes past hws array
  4. Execution
    Out-of-bounds read of kernel memory
  5. Impact
    Info disclosure or kernel crash (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation is limited to Linux systems running on Microchip PolarFire SoC hardware with the clk-mpfs-ccc driver (CONFIG_MCHP_CLK_MPFS_CCC) enabled and a CCC device present, because the out-of-bounds access occurs specifically while that driver registers its PLL output clocks. The CVSS vector indicates local access with low privileges (AV:L/PR:L) and no user interaction, but the defect manifests during automatic driver probe rather than from attacker-controlled data, which sharply limits deliberate exploitation. Limiting factors: non-x86, hardware-specific deployment (RISC-V PolarFire SoC only), the driver must be compiled in and bound, and the trigger is tied to kernel/driver initialization rather than a remotely reachable input.
Impact

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, base 7.1) rates this High, driven by high confidentiality and availability impact via local, low-privilege access. However, corroborating signals point to low real-world risk: EPSS is 0.02% (7th percentile), the CVE is not in CISA KEV, and no POC is referenced. Critically, the out-of-bounds access happens automatically during driver probe/registration on affected hardware rather than through attacker-supplied input, so the attacker framing is weak - this behaves more like a boot-time reliability defect than a controllable exploit primitive. The C:H rating (implying attacker-controlled disclosure) should be treated with caution: the description and CWE-125 indicate an OOB read triggered by a static ID mismatch, not a data-exfiltration channel an attacker steers. Net: a real priority only for operators running Linux on Microchip PolarFire SoC boards; broadly a low-urgency hardening fix.
Exploit ScenarioDerived

A low-privileged local user on a Microchip PolarFire SoC Linux system triggers the vulnerable path when the mpfs-ccc driver registers its clock outputs (at boot or on driver load), causing reads beyond the hws array that can leak adjacent kernel memory or crash the kernel. Because the flaw is exercised by the driver's own registration logic rather than crafted attacker input, reliable weaponization is unlikely and no POC is referenced. Given AV:L/AC:L, any exploitation requires local presence on the specific hardware.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

Out-of-bounds memory access in the Linux kernel's Microchip PolarFire SoC clock conditioning circuit driver (clk-mpfs-ccc) occurs during registration of the final clock outputs, because the driver's hws array is sized only for two PLLs and their four dividers while the defined clock IDs also enumerate two unsupported DLLs and their outputs. On affected Microchip PolarFire SoC hardware this leads to reads past the allocated array (flagged by UBSAN), enabling information disclosure or a kernel crash. There is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.02%).

RemediationAI

Vendor-released patch: update to a fixed Linux stable release - 6.1.175, 6.6.140, 6.12.88, 6.18.30 or 7.0.7 (fix also in 7.1-rc1/mainline) - or apply the corresponding stable commit from git.kernel.org (e.g. https://git.kernel.org/stable/c/9ed9b580a814773482c0a4f1be045636e68cc109). For distribution kernels, take the vendor's patched build for your series. If immediate patching is not possible and the platform is not Microchip PolarFire SoC, practical exposure is nil and no urgent action is required. On PolarFire SoC systems where you cannot yet update, a compensating control is to disable/omit the mpfs-ccc clock driver (CONFIG_MCHP_CLK_MPFS_CCC) in the kernel config if the CCC-derived clocks are not needed - the trade-off is loss of those clock outputs, which may break peripherals that depend on them, so validate hardware bring-up before deploying.

Affected VersionsENISA

Linux patch: 6.6.140
Linux d39fb172760e426e0628f16b785c85e16d17bd5e <a0780aeea166a7cf4706c45af4cadbb2a43a1fc9
Linux d39fb172760e426e0628f16b785c85e16d17bd5e <9ed9b580a814773482c0a4f1be045636e68cc109
Linux patch: 6.12.88
Linux patch: 7.1-rc1
Linux patch: 6.18.30
Linux patch: 7.0.7
Linux d39fb172760e426e0628f16b785c85e16d17bd5e <f24efd415455b98a1f1cfc6071fe6fde71986706
Linux d39fb172760e426e0628f16b785c85e16d17bd5e <dbfcb09656cb30439577325c9dea2250203c2e3c
Linux 6.1
Linux d39fb172760e426e0628f16b785c85e16d17bd5e <47bc7a03449c39805bc2665d3e57c73195d5bcf8
Linux patch: 6.1.175
Linux d39fb172760e426e0628f16b785c85e16d17bd5e <2f7ae8ab6aa73daaf080d5332110357c29df9c36
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is drivers/clk/microchip/clk-mpfs-ccc.c, the Common Clock Framework driver for the Clock Conditioning Circuit (CCC) on Microchip's PolarFire SoC, a RISC-V system-on-chip. During probe the driver populates a clk_hw_onecell_data hws array but only allocates space for the two supported PLLs and their four output dividers each. The defined ID enumeration order is PLLs -> DLLs -> PLL outputs -> DLL outputs, and because the two DLLs and their outputs are not supported by the driver, indexing the PLL output IDs directly overshoots the allocated array. This is a classic CWE-125 (Out-of-bounds Read) rooted in an index/allocation-size mismatch; the fix decrements the PLL output IDs by two so they map back into the correctly sized array.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 6.1 MEDIUM

Local, low-priv trigger during driver probe on specific hardware; OOB read yields at most a limited info leak (C:L) but can crash the kernel (A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 08, 2026 - 19:07 NVD
7.1 (HIGH)
Patch available
Jun 08, 2026 - 18:01 EUVD
CVE Published
Jun 08, 2026 - 15:46 nvd
HIGH 7.1
CVE Published
Jun 08, 2026 - 15:46 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

clk: microchip: mpfs-ccc: fix out of bounds access during output registration

UBSAN reported an out of bounds access during registration of the last two outputs. This out of bounds access occurs because space is only allocated in the hws array for two PLLs and the four output dividers that each has, but the defined IDs contain two DLLS and their two outputs each, which are not supported by the driver. The ID order is PLLs -> DLLs -> PLL outputs -> DLL outputs. Decrement the PLL output IDs by two while adding them to the array to avoid the problem.

Executive ViewAI

Why It Matters

A memory vulnerability in Linux kernel support for Microchip PolarFire SoC devices can enable unauthorized information access or cause system failures on affected embedded platforms. Organizations with PolarFire SoC deployments face operational disruption and confidentiality risks that are mitigatable through available vendor patches.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Prevalence
Low
vulnerable code runs only on niche Microchip PolarFire SoC hardware
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46293 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/369262 REF https://git.kernel.org/stable/c/2f7ae8ab6aa73daaf080d5332110357c29df9c36 REF https://git.kernel.org/stable/c/47bc7a03449c39805bc2665d3e57c73195d5bcf8 REF https://git.kernel.org/stable/c/9ed9b580a814773482c0a4f1be045636e68cc109 REF https://git.kernel.org/stable/c/a0780aeea166a7cf4706c45af4cadbb2a43a1fc9 REF https://git.kernel.org/stable/c/dbfcb09656cb30439577325c9dea2250203c2e3c REF https://git.kernel.org/stable/c/f24efd415455b98a1f1cfc6071fe6fde71986706

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy