Stack-Allocated Structure Vulnerability in Linux Kernel Affecting EIC7700 Hardware

CVE-2026-93263

What is CVE-2026-93263?

A vulnerability in the Linux kernel occurs when stack-allocated structures, such as clk_init_data, are not fully initialized, leading to potential undefined behavior. The function eswin_clk_register_pll() fails to initialize all fields of the struct, which can result in garbage values being used. This causes issues in parent resolution and may lead to kernel panics upon dereferencing a NULL pointer. Observed on EIC7700 hardware, the impact of this vulnerability can vary based on the state of the stack at the time of execution. To mitigate this issue, it is crucial to ensure that both the clk_init_data structures are zero-initialized.

References