CVE-2026-93272: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-24 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 The changes introduced to handle single power domain platforms have swapped the info pointer increment from num_pd_vregs to num_pds, which would shift the info pointer past the end of the array for pronto-v3, which does not list power domain regulators in vregs. This showed up as a difference between GCC- and LLVM-compiled kernels on SDM632 devices, where only with LLVM one would get the "regulator request with no identifier" error, because the out-of-bounds memory ended up being zeroed. Fix by skipping the increment when there are more power domains than regulators.

Affected products

Linux: from 6.1.141 before 6.1.191; from 6.6.93 before 6.6.160; from 6.12.31 before 6.12.114; from 5.15.185 before 5.16; from 6.14.9 before 6.15 — fixed in 6.1.191, 6.6.160, 6.12.114, 5.16, 6.15

How to fix

Upgrade to a fixed version: Linux 6.1.191, 6.6.160, 6.12.114, 5.16. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-93272 or the next vulnerability affects your stack