Bug 2536171 (CVE-2026-90274) - CVE-2026-90274 kernel: coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
Summary: CVE-2026-90274 kernel: coresight: etm4x: fix underflow for usage of (nrseqsta...
Keywords:
Status: NEW
Alias: CVE-2026-90274
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-17 16:41 UTC by OSIDB Bzimport
Modified: 2026-10-15 12:35 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-17 16:41:09 UTC
In the Linux kernel, the following vulnerability has been resolved:

coresight: etm4x: fix underflow for usage of (nrseqstate - 1)

According to IHI006H Embedded Trace Macrocell Architecture
Specification[0], TRCSEQEVR<n> is implemented only when
TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0 to 2;
otherwise, TRCIDR5.NUMSEQSTATE is 0b000.

IOW, the number of usage in the initialisation or setting
TRCSEQEVR<n> with drvdata->nrseqstate - 1 in the loop could make
underflow issue when TRCIDR5.NUMSEQSTATE is 0b000.

Therefore, introduce nr_seq_ctrls field and untie it from nrseqstate.
As part of this introduce ETM_MAX_SEQ_TRANSITIONS macro and
apply nr_seq_ctrls and above macro to TRCSEQEVR<n> relevant fields setup.


Note You need to log in before you can comment on or make changes to this bug.