Executive brief
The Linux kernel's driver for Intel LJCA USB devices contains a stack buffer overflow vulnerability in the GPIO enumeration function. A malicious or malfunctioning LJCA device can send a specially crafted response that causes the kernel to write beyond the bounds of a fixed-size array, potentially leading to kernel memory corruption, denial of service, or privilege escalation on systems with affected devices connected.
Technical details
The vulnerability is a stack buffer overflow in the ljca_enumerate_gpio() function within drivers/usb/misc/usb-ljca.c. The function reads an unconstrained bank_num value from a USB device descriptor and uses it to loop through a fixed-size valid_pin[] array that holds only 2 entries (LJCA_MAX_GPIO_NUM / 32 = 64 / 32 = 2). Existing validation checks the struct size and the product of pins_per_bank * bank_num against LJCA_MAX_GPIO_NUM, but neither bounds bank_num against the valid_pin array size. A device reporting bank_num = 9 with pins_per_bank = 7 passes both existing checks (gpio_num = 63, reply = 56 bytes), but the loop writes nine u32 values into the two-entry array, overflowing the stack. The fix adds a simple bounds check rejecting any bank_num > ARRAY_SIZE(valid_pin). The vulnerability requires physical proximity (USB device connection) but affects any kernel version since the LJCA support was added.
Affected products
- Linux Linux kernel All versions with LJCA USB driver support (since commit acd6199f195d)
Timeline
- 2026-09-17: disclosed: CVE-2026-93119 published
- 2026-06-18: patched: Fix committed upstream (commit dd9483726d0f16a)
- 2026-09-14: patched: Fix backported to stable trees