CVE-2026-93119

A flaw was found in the kernel. Specifically, within the USB LJCA driver's ljca_enumerate_gpio() function, an attacker with a specially crafted malicious LJCA device could provide an unbounded bank_num value. This improper handling of input leads to a stack overflow, which could result in a denial of service (DoS) or potentially arbitrary code execution.

A stack based buffer overflow in the USB LJCA GPIO enumeration path can occur because ljca_enumerate_gpio trusts desc bank_num from the device more than the size of the local valid_pin array. A malicious or broken LJCA USB device can report a bank_num that passes the existing reply length and gpio_num checks while still causing the loop to write more u32 entries than valid_pin can hold. For the CVSS the PR:N because the attacker does not need an account on the target if they can present a crafted physical USB device. The issue is not network reachable and requires physical USB device access or an equivalent USB redirection path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.