{"id":"CVE-2026-90274","revision":"cff41b7abcad40c1889920df807a4ed5","records":[{"revision":"cff41b7abcad40c1889920df807a4ed5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90274","aliases":[],"title":"coresight: etm4x: fix underflow for usage of (nrseqstate - 1)","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: etm4x: fix underflow for usage of (nrseqstate - 1)\n\nAccording to IHI006H Embedded Trace Macrocell Architecture\nSpecification[0], TRCSEQEVR<n> is implemented only when\nTRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0 to 2;\notherwise, TRCIDR5.NUMSEQSTATE is 0b000.\n\nIOW, the number of usage in the initialisation or setting\nTRCSEQEVR<n> with drvdata->nrseqstate - 1 in the loop could make\nunderflow issue when TRCIDR5.NUMSEQSTATE is 0b000.\n\nTherefore, introduce nr_seq_ctrls field and untie it from nrseqstate.\nAs part of this introduce ETM_MAX_SEQ_TRANSITIONS macro and\napply nr_seq_ctrls and above macro to TRCSEQEVR<n> relevant fields setup.","state":0,"publishedAt":"2026-09-17T16:08:07.269+00:00","modifiedAt":"2026-10-19T09:00:51.909+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/hwtracing/coresight/coresight-etm4x-cfg.c\",\n                        \"drivers/hwtracing/coresight/coresight-etm4x-core.c\",\n                        \"drivers/hwtracing/coresight/coresight-etm4x-sysfs.c\",\n                        \"drivers/hwtracing/coresight/coresight-etm4x.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2e1cdfe184b5202d51e0611d7a051e2bea303946\",\n                            \"lessThan\": \"8d669db59f7283b838e029af29da12e505265fae\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2e1cdfe184b5202d51e0611d7a051e2bea303946\",\n                            \"lessThan\": \"4091f2d5b26d117c992ffcce1a5df425a0daedcd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2e1cdfe184b5202d51e0611d7a051e2bea303946\",\n                            \"lessThan\": \"be7b2de5b9a96ae68ffa3528e0a40d63e0fd8148\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2e1cdfe184b5202d51e0611d7a051e2bea303946\",\n                            \"lessThan\": \"4f9a0f548413bf864f609c9f4bc56e3f1b3577d4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2e1cdfe184b5202d51e0611d7a051e2bea303946\",\n                            \"lessThan\": \"1ade9a335c69fc735cb7b3f222ed35ab135540fb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2e1cdfe184b5202d51e0611d7a051e2bea303946\",\n                            \"lessThan\": \"5ac900f73ce1d4d8308f40752b51bc8a02b244d2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2e1cdfe184b5202d51e0611d7a051e2bea303946\",\n                            \"lessThan\": \"1674d9bff8073bdee5dbc200f56fc3caa28d0566\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/hwtracing/coresight/coresight-etm4x-cfg.c\",\n                        \"drivers/hwtracing/coresight/coresight-etm4x-core.c\",\n                        \"drivers/hwtracing/coresight/coresight-etm4x-sysfs.c\",\n                        \"drivers/hwtracing/coresight/coresight-etm4x.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/8d669db59f7283b838e029af29da12e505265fae","https://git.kernel.org/stable/c/4091f2d5b26d117c992ffcce1a5df425a0daedcd","https://git.kernel.org/stable/c/be7b2de5b9a96ae68ffa3528e0a40d63e0fd8148","https://git.kernel.org/stable/c/4f9a0f548413bf864f609c9f4bc56e3f1b3577d4","https://git.kernel.org/stable/c/1ade9a335c69fc735cb7b3f222ed35ab135540fb","https://git.kernel.org/stable/c/5ac900f73ce1d4d8308f40752b51bc8a02b244d2","https://git.kernel.org/stable/c/1674d9bff8073bdee5dbc200f56fc3caa28d0566"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90274","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90274","identifiers":["CVE-2026-90274"]},"retained":false,"historicalAffected":[]}],"coverage":[]}