PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46293 Linux CVE debrief

A Linux kernel vulnerability, CVE-2026-46293, was identified in clk: microchip: mpfs-ccc. The issue involves an out of bounds access during output registration. According to the description, UBSAN reported an out of bounds access during registration of the last two outputs. This occurs because space is only allocated in the hws array for two PLLs and the four output dividers that each has, but the defined IDs contain two DLLS and their two outputs each, which are not supported by the driver.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of the Linux kernel, specifically those utilizing clk: microchip: mpfs-ccc, should be aware of this vulnerability. This issue may impact systems relying on the affected driver.

Technical summary

The vulnerability arises from an out of bounds access during output registration in clk: microchip: mpfs-ccc. The problem is caused by insufficient space allocation in the hws array for the defined IDs, which include unsupported DLLs and their outputs.

Defensive priority

Medium

Recommended defensive actions

  • Apply the provided patches to resolve the vulnerability.
  • Review and update affected systems to ensure the fix is implemented.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46293 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46293

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46293 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46293

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2f7ae8ab6aa73daaf080d5332110357c29df9c36

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/47bc7a03449c39805bc2665d3e57c73195d5bcf8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9ed9b580a814773482c0a4f1be045636e68cc109

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a0780aeea166a7cf4706c45af4cadbb2a43a1fc9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/dbfcb09656cb30439577325c9dea2250203c2e3c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f24efd415455b98a1f1cfc6071fe6fde71986706

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.