{
  "cveId": "CVE-2026-93266",
  "url": "https://patchblox.com/security/cve/CVE-2026-93266",
  "summary": "CVE-2026-93266 is fixed in linux on 1 platform by DEBIAN-CVE-2026-93266 (version 7.2.6-1), released September 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  arm64: RSI: fix field-spanning write warning in...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  arm64: RSI: fix field-spanning write warning in attestation token init  The challenge is passed in registers a1 through a8. However, copying to \u0026regs.a1 makes FORTIFY treat the destination as the single a1 field, resulting in a field-spanning write warning. [1]  Overlay the SMCCC register structure with an RSI-specific argument layout and copy the challenge into an explicit 64-byte array. This keeps the existing a1-a8 argument encoding while giving the copy a correctly sized destination object.  [1] memcpy: detected field-spanning write (size 64) of single field \u0022\u0026regs.a1\u0022 at ./arch/arm64/include/asm/rsi_cmds.h:119 (size 8) WARNING: ./arch/arm64/include/asm/rsi_cmds.h:119 at rsi_attestation_token_init\u002B0xdc/0xf8 [arm_cca_guest], CPU#0: cat/3314",
  "published": "2026-09-24T16:17:23Z",
  "severity": "",
  "epss": 0.00184,
  "epssPercentile": 0.0806,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-93266",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-93266",
      "released": "2026-09-24T19:30:44Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}