coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
Summary
| CVE | CVE-2026-90274 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-09-17 17:17:23 UTC |
|---|
| Updated | 2026-09-17 17:17:23 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
According to IHI006H Embedded Trace Macrocell Architecture
Specification[0], TRCSEQEVR<n> is implemented only when
TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0 to 2;
otherwise, TRCIDR5.NUMSEQSTATE is 0b000.
IOW, the number of usage in the initialisation or setting
TRCSEQEVR<n> with drvdata->nrseqstate - 1 in the loop could make
underflow issue when TRCIDR5.NUMSEQSTATE is 0b000.
Therefore, introduce nr_seq_ctrls field and untie it from nrseqstate.
As part of this introduce ETM_MAX_SEQ_TRANSITIONS macro and
apply nr_seq_ctrls and above macro to TRCSEQEVR<n> relevant fields setup. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 2e1cdfe184b5202d51e0611d7a051e2bea303946 8d669db59f7283b838e029af29da12e505265fae git |
Not specified |
| CNA |
Linux |
Linux |
affected 2e1cdfe184b5202d51e0611d7a051e2bea303946 4091f2d5b26d117c992ffcce1a5df425a0daedcd git |
Not specified |
| CNA |
Linux |
Linux |
affected 2e1cdfe184b5202d51e0611d7a051e2bea303946 be7b2de5b9a96ae68ffa3528e0a40d63e0fd8148 git |
Not specified |
| CNA |
Linux |
Linux |
affected 2e1cdfe184b5202d51e0611d7a051e2bea303946 4f9a0f548413bf864f609c9f4bc56e3f1b3577d4 git |
Not specified |
| CNA |
Linux |
Linux |
affected 2e1cdfe184b5202d51e0611d7a051e2bea303946 1ade9a335c69fc735cb7b3f222ed35ab135540fb git |
Not specified |
| CNA |
Linux |
Linux |
affected 2e1cdfe184b5202d51e0611d7a051e2bea303946 5ac900f73ce1d4d8308f40752b51bc8a02b244d2 git |
Not specified |
| CNA |
Linux |
Linux |
affected 2e1cdfe184b5202d51e0611d7a051e2bea303946 1674d9bff8073bdee5dbc200f56fc3caa28d0566 git |
Not specified |
| CNA |
Linux |
Linux |
affected 4.2 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 4.2 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.15.221 5.15.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.1.188 6.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.157 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.110 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.52 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.6 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3-rc1 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/1674d9bff8073bdee5dbc200f56fc3caa28d0566 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/5ac900f73ce1d4d8308f40752b51bc8a02b244d2 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/be7b2de5b9a96ae68ffa3528e0a40d63e0fd8148 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/4f9a0f548413bf864f609c9f4bc56e3f1b3577d4 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/1ade9a335c69fc735cb7b3f222ed35ab135540fb |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/8d669db59f7283b838e029af29da12e505265fae |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/4091f2d5b26d117c992ffcce1a5df425a0daedcd |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.