CVE-2026-93061
gpu: host1x: Avoid stack over-read in debug output helpers
Description
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. That return value was passed straight to o->fn as the number of bytes to emit. This could cause a read past end of the output buffer if a call to host1x_debug_* produced a string longer than 256 bytes. This only affected the debugfs files as the printk debug sink ignores the number of bytes. In practice, this is very unlikely to occur. Fix by switching to vscnprintf(), which returns the number of bytes actually written.
INFO
Published Date :
Sept. 17, 2026, 5:17 p.m.
Last Modified :
Sept. 17, 2026, 5:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update the Linux kernel.
- Apply the patch for host1x debug output.
- Switch to vscnprintf for buffer safety.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-93061.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-93061 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-93061
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-93061 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-93061 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 17, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. That return value was passed straight to o->fn as the number of bytes to emit. This could cause a read past end of the output buffer if a call to host1x_debug_* produced a string longer than 256 bytes. This only affected the debugfs files as the printk debug sink ignores the number of bytes. In practice, this is very unlikely to occur. Fix by switching to vscnprintf(), which returns the number of bytes actually written. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/93xxx/CVE-2026-93061.json">CVE-2026-93061</a> Added Reference https://git.kernel.org/stable/c/41517c46002afd717f0f2d0975c740dd610f87fe Added Reference https://git.kernel.org/stable/c/4f9f0afdbdf513a49065207ff6b7e1d15051175a Added Reference https://git.kernel.org/stable/c/819dd96a6571f2b12496b080e5187ba3fa897232 Added Reference https://git.kernel.org/stable/c/9ad7a6ccc7b839247663d57d3dbb4481dec492de Added Reference https://git.kernel.org/stable/c/b00290d1dc23a5ef9a0d3103aad1fe2274e86569 Added Reference https://git.kernel.org/stable/c/bc17ac285fb708f22a8fa2c0ed32eceb1d37e6d6 Added Reference https://git.kernel.org/stable/c/d7a560dc912756fd8b39b28b10818d931e863d2d Added Reference https://git.kernel.org/stable/c/ebab3a25a0403bcbc0c40ef77d69d23270e45547