CVE-2026-93119

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: ljca: bound bank_num in ljca_enumerate_gpio()

ljca_enumerate_gpio() reads desc->bank_num from the device and loops

valid_pin[i] = get_unaligned_le32(...) for i < bank_num. valid_pin[]

holds only LJCA_MAX_GPIO_NUM / 32 = 2 entries.

Two checks run before the loop. The reply length must match

struct_size(desc, bank_desc, bank_num). The product

pins_per_bank * bank_num must not exceed LJCA_MAX_GPIO_NUM. Neither one

bounds bank_num against the size of valid_pin[]. The reply is capped at

LJCA_MAX_PAYLOAD_SIZE (60) bytes, so the struct_size check limits

bank_num to 9. A device that reports bank_num 9 with pins_per_bank 7

still passes both checks. gpio_num is 63 and the reply is 56 bytes. The

loop then writes nine u32 into the two entry array and overruns

valid_pin[] on the stack.

A broken or malicious LJCA device can therefore overflow the stack.

Reject a bank_num that does not fit valid_pin[].

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References