Riskcovery

CVE-2026-90274

coresight: etm4x: fix underflow for usage of (nrseqstate - 1)

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

coresight: etm4x: fix underflow for usage of (nrseqstate - 1)

According to IHI006H Embedded Trace Macrocell Architecture Specification[0], TRCSEQEVR<n> is implemented only when TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0 to 2; otherwise, TRCIDR5.NUMSEQSTATE is 0b000.

IOW, the number of usage in the initialisation or setting TRCSEQEVR<n> with drvdata->nrseqstate - 1 in the loop could make underflow issue when TRCIDR5.NUMSEQSTATE is 0b000.

Therefore, introduce nr_seq_ctrls field and untie it from nrseqstate. As part of this introduce ETM_MAX_SEQ_TRANSITIONS macro and apply nr_seq_ctrls and above macro to TRCSEQEVR<n> relevant fields setup.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 2e1cdfe184b5202d51e0611d7a051e2bea303946 to before 8d669db59f7283b838e029af29da12e505265faeAffected
  • 2e1cdfe184b5202d51e0611d7a051e2bea303946 to before 4091f2d5b26d117c992ffcce1a5df425a0daedcdAffected
  • 2e1cdfe184b5202d51e0611d7a051e2bea303946 to before be7b2de5b9a96ae68ffa3528e0a40d63e0fd8148Affected
  • 2e1cdfe184b5202d51e0611d7a051e2bea303946 to before 4f9a0f548413bf864f609c9f4bc56e3f1b3577d4Affected
  • 2e1cdfe184b5202d51e0611d7a051e2bea303946 to before 1ade9a335c69fc735cb7b3f222ed35ab135540fbAffected
  • 2e1cdfe184b5202d51e0611d7a051e2bea303946 to before 5ac900f73ce1d4d8308f40752b51bc8a02b244d2Affected
  • 2e1cdfe184b5202d51e0611d7a051e2bea303946 to before 1674d9bff8073bdee5dbc200f56fc3caa28d0566Affected
LinuxLinux
  • 4.2Affected
  • before 4.2Not affected
  • 5.15.221 through 5.15.*Not affected
  • 6.1.188 through 6.1.*Not affected
  • 6.6.157 through 6.6.*Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.