Homepage

CVE-2026-93165 Affecting linux-6.12 package, versions <6.12.111-1~deb12u1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.19% (8th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-LINUX612-20507351
  • published5 Oct 2026
  • disclosed17 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 17 Sep 2026

NewCVE-2026-93165  (opens in a new tab)

How to fix?

Upgrade Debian:12 linux-6.12 to version 6.12.111-1~deb12u1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream linux-6.12 package and not the linux-6.12 package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

platform/chrome: sensorhub: Fix memory overread in ring handler

max_response and sensor_num are read from different EC commands:

  • max_response is from cros_ec_get_proto_info(). ec_dev->max_response = info->max_response_packet_size - sizeof(struct ec_host_response);

  • sensor_num is from cros_ec_get_sensor_count(). sensor_num = cros_ec_get_sensor_count(ec);

With a malfunctioning EC firmware, it is possible that the msg-&gt;insize (i.e., fifo_info_length in the context) could be clamped in cros_ec_cmd_xfer() because msg-&gt;insize is greater than max_response.

int fifo_info_length =
        sizeof(struct ec_response_motion_sense_fifo_info) +
        sizeof(u16) * sensorhub-&gt;sensor_num;

This means the number of read bytes could be less than expected. As a result, the subsequent memcpy() in cros_ec_sensorhub_ring_handler() overreads the resp-&gt;fifo_info buffer.

Check the return value of cros_ec_cmd_xfer_status() and abort if the number of bytes read does not match the expected length.