Description

In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node DSP3 has an integrated Ethernet MAC Endpoint which has its own set of config registers for configuring settings such as ASPM. The Endpoint device has two physical functions and those two functions share the same settings. Parse the Endpoint node under DSP3 instead of parsing both functions. The existing parsing logic also has one OOB issue as parsing both functions will result in accessing past the tc9563_pwrctrl->cfg array.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-24T16:17:23.340Z",
  "pubdate": "2026-09-24T16:17:23.340Z",
  "executiveSummary": "A vulnerability has been identified in the Linux kernel PCI/pwrctrl driver specifically involving the TC9563 integrated Ethernet MAC Endpoint node parsing logic.\nThe flaw is categorized as an Out-of-Bounds (OOB) memory access vulnerability resulting from improper iteration during device tree node parsing.\nThis vulnerability affects systems utilizing the TC9563 PCIe-to-Ethernet controller, potentially allowing a local attacker or a malicious device configuration to induce memory corruption.\nThe risk implication involves kernel-level memory corruption which could lead to system instability, denial of service (DoS), or potentially arbitrary code execution depending on the proximity of the overflow to sensitive kernel structures.\nExploitation is typically triggered at system boot or during driver initialization when the kernel processes the device tree nodes associated with the Ethernet MAC Endpoint.\nNo specific network-based exploitation is required; however, the impact is severe due to the potential for kernel heap or stack corruption.",
  "technicalDetails": "The vulnerability resides within the tc9563_pwrctrl driver logic responsible for configuring power control registers and ASPM (Active State Power Management) settings for the integrated Ethernet MAC Endpoint within the DSP3 block.\nThe TC9563 device exposes two physical functions (PFs) which share a unified set of configuration registers. The root cause of this vulnerability is a logical flaw in the iteration and parsing mechanism for the Endpoint node.\nThe driver attempts to parse individual configuration nodes for both physical functions separately. During this parsing operation, the implementation iterates past the bounds of the tc9563_pwrctrl->cfg array. Because the array is indexed based on the assumption of distinct configuration structures per function, the kernel attempts to access memory addresses outside the allocated boundary of the structure when processing the second function.\nStep-by-step exploitation flow: 1. The Linux kernel initiates the tc9563_pwrctrl driver during the probe phase. 2. The driver parses the device tree to locate the Ethernet MAC Endpoint node under DSP3. 3. The parsing logic executes a loop meant to map configuration registers. 4. Due to the lack of bounds checking and the incorrect assumption that both PFs require independent array entries, the logic increments the pointer beyond the tc9563_pwrctrl->cfg array limit. 5. The kernel performs an OOB write or read operation to the memory address immediately following the allocated array.\nThis results in a buffer overflow scenario. If an attacker can influence the device tree blob (DTB) provided to the kernel—common in embedded environments with insecure boot chains—they can potentially redirect control flow by overwriting adjacent memory objects. Even without DTB manipulation, the OOB access constitutes a significant stability risk, as the kernel may panic upon encountering a page fault or corrupt kernel metadata used by the slab allocator.\nThe vulnerable component is the tc9563 parsing logic within the PCI power control subsystem. The issue is present in versions of the Linux kernel where the tc9563_pwrctrl driver was introduced prior to the application of the upstream fix. The vulnerability does not require authentication once the kernel is initialized, as it is triggered automatically by the driver's standard initialization routine."
}