CVE-2026-93118 Affecting linux-6.12 package, versions <6.12.111-1~deb12u1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIAN12-LINUX612-20507316
- published5 Oct 2026
- disclosed17 Sept 2026
Introduced: 17 Sep 2026
NewCVE-2026-93118 (opens in a new tab)How to fix?
Upgrade Debian:12 linux-6.12 to version 6.12.111-1~deb12u1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream linux-6.12 package and not the linux-6.12 package as distributed by Debian.
See How to fix? for Debian:12 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: aspeed_udc: check endpoint DMA allocation
ast_udc_probe() allocates a coherent DMA buffer used as the backing store for endpoint buffers. ast_udc_init_ep() derives per-endpoint buffer pointers from udc->ep0_buf, so a failed allocation is dereferenced during probe.
Check the allocation before endpoint setup. The existing probe error path called ast_udc_remove(), which unregisters the gadget unconditionally and is not safe before usb_add_gadget_udc() succeeds. Add a local cleanup helper for probe failures so pre-registration failures only unwind the resources that were actually initialized.
This was found by a local static analysis checker for unchecked allocator returns while scanning Linux 6.16. The change was checked by applying it to current mainline and by running checkpatch. I do not have access to Aspeed UDC hardware, so no runtime testing was performed.
References
- https://security-tracker.debian.org/tracker/CVE-2026-93118
- https://git.kernel.org/stable/c/4aaad88f857498ed1294f061f0b25d27ae891c55
- https://git.kernel.org/stable/c/6182e708e2e1f55521c8a01d7535630ecc2d7df9
- https://git.kernel.org/stable/c/97cee53a94be3bd4fd8fbed6071bd2f32dad1ab1
- https://git.kernel.org/stable/c/9e6f57107c1886052d4baaa047a2bc3d0e91be5d
- https://git.kernel.org/stable/c/d7ae1a48e70e9c3451b7dc7bc3896c82884bc4df
- https://git.kernel.org/stable/c/ff6e88e29965bd06f640e59acdcf0bbf04a7f55c