Cloudanix VulnDB

CVE-2026-99020

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A counting error in a power-control driver can make the system read the wrong memory during startup on certain chips, risking crashes that need a software update to prevent.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect n_linear_ranges value (4 instead of 2) in TPS65224/TPS652G1 BUCK descriptors causes linear range helpers to perform out-of-bounds reads past the end of tps65224_bucks_2_3_4_ranges[] during voltage constraint validation on regulator registration.

Why it matters to the business

Risk of kernel crashes or instability during boot or device initialization on embedded systems using affected TI regulators, with elevated urgency due to publication only 2 days ago and potential for widespread impact in Linux-based embedded ecosystems.

How an attack unfolds

On systems with TPS65224 or TPS652G1 hardware, the normal regulator registration path triggers the core to iterate over an overstated number of linear ranges, causing the kernel to treat adjacent memory as valid range descriptors and read out of bounds.

How to fix it

Update the Linux kernel to a version containing the ARRAY_SIZE() fix for n_linear_ranges in the tps6594-regulator driver; rebuild and deploy any downstream distributions or embedded images that incorporate the corrected descriptors.

How to confirm the fix worked

Review the tps6594-regulator.c source to confirm n_linear_ranges assignments use ARRAY_SIZE() on the corresponding range tables, then boot an affected platform and verify successful regulator registration without kernel faults.

Typical attack path

  1. Load or probe the tps6594-regulator driver on affected hardware
  2. Core regulator framework validates voltage constraints against all selectors
  3. Loop iterates n_linear_ranges times over an array containing only two entries
  4. Out-of-bounds read occurs, treating subsequent memory as additional range structures

How to detect it

Search kernel logs and crash dumps for oops or panic messages occurring during regulator registration or voltage table lookups on platforms with TI TPS65224 regulators.

What your security team should do

  • Expedite kernel updates on all systems using TPS65224 or TPS652G1 regulators given the 2-day publication window
  • Test regulator initialization paths in staging environments before production rollout
  • Add kernel oops monitoring for regulator-related crashes

The record

In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as n_linear_ranges, but tps65224_bucks_2_3_4_ranges[] only has two entries, covering selectors 0x00-0x45. The linear range helpers loop over n_linear_ranges entries, so any lookup of a selector above 0x45 reads past the end of the array and treats whatever follows it as two more ranges. This happens on the normal registration path when the core checks the voltage constraints against every selector. TPS652G1 uses the same descriptors and is affected too. Use ARRAY_SIZE() so the count always matches the table.

Affected packages

Ecosystem Package Introduced Fixed