{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  usb: ljca: bound bank_num in ljca_enumerate_gpio()  ljca_enumerate_gpio() reads desc-\u003ebank_num from the device and loops valid_pin[i] = get_unaligned_le32(...) for i \u003c bank_num. valid_pin[] holds only LJCA_MAX_GPIO_NUM / 32 = 2 entries.  Two checks run before the loop. The reply length must match struct_size(desc, bank_desc, bank_num). The product pins_per_bank * bank_num must not exceed LJCA_MAX_GPIO_NUM. Neither one bounds bank_num against the size of valid_pin[]. The reply is capped at LJCA_MAX_PAYLOAD_SIZE (60) bytes, so the struct_size check limits bank_num to 9. A device that reports bank_num 9 with pins_per_bank 7 still passes both checks. gpio_num is 63 and the reply is 56 bytes. The loop then writes nine u32 into the two entry array and overruns valid_pin[] on the stack.  A broken or malicious LJCA device can therefore overflow the stack. Reject a bank_num that does not fit valid_pin[].",
  "id": "DEBIAN-CVE-2026-93119",
  "modified": "2026-09-18T04:47:33.186746400Z",
  "published": "2026-09-17T17:18:06.553Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-93119"
    }
  ],
  "upstream": [
    "CVE-2026-93119"
  ]
}