Quick answers
- Is CVE-2026-99259 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-99259 being exploited in the wild.
- How severe is CVE-2026-99259?
- Informational severity, published 3 November 2026.
- Which products and versions are affected?
- Linux Kernel versions containing commit 4d61f0342689 and before fix commit c5c95dbdc9011a56359df4dc00be829bbcc0b036.
- Is there a fix for CVE-2026-99259?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-99259 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-99259?
- Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An uninitialized early_pmc->rate variable in the tegra_pmc_probe() function causes the tegra_pmc_enter_suspend_mode() function to trigger a warning when called on 32-bit Tegra devices. The issue was introduced when the PMC driver was refactored to create the PMC context dynamically; the rate was set in the new dynamic context but not copied to the legacy early PMC context. The fix is a single-line assignment that copies the rate value to the early context during initialization.
Affected products
- Linux kernel versions containing commit 4d61f0342689 and before fix commit c5c95dbdc9011a56359df4dc00be829bbcc0b036
Timeline
- 2026-11-03: disclosed