Executive brief
The Linux kernel's TC9563 PCI power control driver incorrectly parses configuration for an integrated Ethernet MAC endpoint, causing an out-of-bounds access to a configuration array. An attacker with access to device tree configuration could trigger memory corruption or information disclosure on affected systems.
Technical details
The vulnerability is an out-of-bounds (OOB) array access in the tc9563_pwrctrl driver's parsing logic. The driver incorrectly iterates through multiple physical functions of the Ethernet MAC endpoint, incrementing the port counter beyond the bounds of the tc9563_pwrctrl->cfg array. The fix ensures only the single Ethernet endpoint node is parsed rather than both physical functions, eliminating the array access violation.
Affected products
- Linux Linux kernel before fix commit 6e5e6c2194b2acbded5b12ed80590d215b786d29
Timeline
- 2026-09-24: disclosed
- 2026-07-27: patched