Cloudanix VulnDB

CVE-2026-93046

High · 7.0

CVSS

7.0

EPSS

0.1%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A mistake in how the Linux kernel checks certain internal references could let a program running on the same computer read or change memory it should not, potentially causing crashes or security problems.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Bounds check in software_node_get_reference_args() fails to reject index value UINT_MAX (equivalent to -1), allowing subsequent out-of-bounds read/write access within the software node property array.

Why it matters to the business

Local attackers with low-privileged access may trigger kernel memory corruption on affected Linux systems, risking denial of service, information disclosure, or limited privilege escalation in specialized configurations; low EPSS and lack of known exploitation reduce immediate enterprise risk.

How an attack unfolds

An attacker with local access crafts a call to software_node_get_reference_args() supplying index -1 (UINT_MAX). The defective bounds check passes, the function indexes beyond the end of the property array, and the resulting memory corruption is leveraged for further exploitation.

How to fix it

Apply the upstream kernel commit that corrects the bounds check for UINT_MAX; rebuild and deploy updated kernel packages for all affected distributions; prioritize systems where local untrusted code execution is possible.

How to confirm the fix worked

Confirm the presence of the corrected bounds check in the running kernel source or binary; test that software_node_get_reference_args() now rejects UINT_MAX; monitor vendor security advisories for backported fixes.

Typical attack path

  1. Obtain local user access on a vulnerable Linux kernel
  2. Identify or create a software node with a property array
  3. Invoke software_node_get_reference_args() with index set to UINT_MAX
  4. Trigger out-of-bounds access to corrupt adjacent kernel memory
  5. Escalate privileges or cause denial of service from the corruption primitive

How to detect it

Search kernel logs and audit trails for unusual calls involving software node property lookups; examine crash dumps for out-of-bounds accesses near software_node structures; no public exploit artifacts are known.

What your security team should do

  • Inventory all Linux systems and identify those running kernels published before the fix date
  • Schedule kernel updates through normal patch management within standard maintenance windows
  • Restrict local code execution on high-value systems via SELinux, AppArmor, or container isolation until patched
  • Review logs for anomalous software-node property accesses as a temporary compensating control

The record

In the Linux kernel, the following vulnerability has been resolved: software node: Fix software_node_get_reference_args() with index -1 The bounds check for the index passed to software_node_get_reference_args() was failing when passed UINT_MAX, this in turn would lead to an out of bound access in the property array. Fix the bound check to also cover the UINT_MAX case.

Affected packages

Ecosystem Package Introduced Fixed