CVE-2026-93213

A flaw was found in the Linux kernel. An out-of-bounds read vulnerability exists in the of_alias_scan() function's stem parser. This issue occurs because the parser checks for a digit before verifying if it's within the valid memory bounds, potentially allowing it to read one byte before the intended property name. This could lead to information disclosure or system instability.

This vulnerability is rated as having a Low impact for Red Hat Enterprise Linux because triggering the condition requires loading a specially crafted Device Tree blob, an operation restricted to system boot firmware or privileged administrators. Unprivileged users cannot manipulate or inject Device Tree alias nodes during standard system operation. As a result, the risk of unauthorized exploitation or unexpected denial of service is negligible in typical production environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.