Homepage

CVE-2026-93165 Affecting kernel-uek-doc package, versions <0:6.12.0-207.111.5.1.el9uek

Severity

 Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.18% (8th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE9-KERNELUEKDOC-20635029
  • published8 Oct 2026
  • disclosed17 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 17 Sep 2026

CVE-2026-93165  (opens in a new tab)

How to fix?

Upgrade Oracle:9 kernel-uek-doc to version 0:6.12.0-207.111.5.1.el9uek or higher.
This issue was patched in ELSA-2026-500374.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-doc package and not the kernel-uek-doc package as distributed by Oracle. See How to fix? for Oracle:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

platform/chrome: sensorhub: Fix memory overread in ring handler

max_response and sensor_num are read from different EC commands:

  • max_response is from cros_ec_get_proto_info(). ec_dev->max_response = info->max_response_packet_size - sizeof(struct ec_host_response);

  • sensor_num is from cros_ec_get_sensor_count(). sensor_num = cros_ec_get_sensor_count(ec);

With a malfunctioning EC firmware, it is possible that the msg-&gt;insize (i.e., fifo_info_length in the context) could be clamped in cros_ec_cmd_xfer() because msg-&gt;insize is greater than max_response.

int fifo_info_length =
        sizeof(struct ec_response_motion_sense_fifo_info) +
        sizeof(u16) * sensorhub-&gt;sensor_num;

This means the number of read bytes could be less than expected. As a result, the subsequent memcpy() in cros_ec_sensorhub_ring_handler() overreads the resp-&gt;fifo_info buffer.

Check the return value of cros_ec_cmd_xfer_status() and abort if the number of bytes read does not match the expected length.