Riskcovery

CVE-2026-99020

regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4

State
Published
Severity
Not scored
Published
Oct 23, 2026
Updated
Oct 23, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4

The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as n_linear_ranges, but tps65224_bucks_2_3_4_ranges[] only has two entries, covering selectors 0x00-0x45.

The linear range helpers loop over n_linear_ranges entries, so any lookup of a selector above 0x45 reads past the end of the array and treats whatever follows it as two more ranges. This happens on the normal registration path when the core checks the voltage constraints against every selector. TPS652G1 uses the same descriptors and is affected too.

Use ARRAY_SIZE() so the count always matches the table.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 54308f24ce510a3ba1bf2e0ebc8b9c8a577b3c3b to before 1ea151615a82fd94f25e38b2cc7eeac49112508bAffected
  • 00c826525fbae0230f6c3e9879e56d50267deb42 to before 66b7da589b2ce44a02b8387c6160e9254685f34fAffected
  • 00c826525fbae0230f6c3e9879e56d50267deb42 to before f6fbe9c6b39968a7696b9badef4bc29331a6376aAffected
  • 00c826525fbae0230f6c3e9879e56d50267deb42 to before f3423b56be12208a393274afb9a5e3d67fc58ce3Affected
  • 00c826525fbae0230f6c3e9879e56d50267deb42 to before 2f15518682c779b1014552cb2ccb4a2052f85f27Affected
  • 6.6.157 to before 6.6.160Affected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.113 through 6.12.*Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.2.11 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.