« Volver al listado

CVE-2026-90386

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices

On an empty bus ENTDAA assigns nothing, so cmd->rx_len (the count of addresses left unassigned) equals master->maxdevs.

The GENMASK() index master->maxdevs - cmd->rx_len - 1 then becomes -1, which trips up UBSAN. This happens every time on boot on a Gigabyte/AMD server:

Skip the mask when no new device was assigned.

Detalles técnicos trazas, registros y código del informe original
    UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12
    shift exponent 64 is too large for 64-bit type 'long unsigned int'
    CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy)
    Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32_F45 04/01/2026
    Call Trace:
     <TASK>
     dump_stack_lvl+0x5d/0x80
     ubsan_epilogue+0x5/0x2b
     __ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab
     dw_i3c_master_daa.cold+0x1b/0x96 [dw_i3c_master]
     i3c_master_do_daa_ext.part.0+0x3e/0xf0 [i3c]

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90386",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef",
              "lessThan": "5650b013e6bfc14c8b30be727f4a715b01860a08",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef",
              "lessThan": "63110ccc434e10d9e9d2c7d82ebfa8a6f9cedd94",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef",
              "lessThan": "3a1c35739efb69e8ec2a868113a0471a01bb8f29",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef",
              "lessThan": "111f559e5b6461f5f6977275716e6c5d1eb7ea27",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef",
              "lessThan": "754533e6169d1f10bdef7a6ba9bd7740b524e1d4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef",
              "lessThan": "9eaac0cb4ca94e2e32c53c156ae5b813ba7ef90c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef",
              "lessThan": "618dd640ded6b94bbdb79c798a901ec564797033",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef",
              "lessThan": "038cf48b3170af26a70bf2dee4f8c3ac910f5176",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/i3c/master/dw-i3c-master.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/i3c/master/dw-i3c-master.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:37.993",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/038cf48b3170af26a70bf2dee4f8c3ac910f5176",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/111f559e5b6461f5f6977275716e6c5d1eb7ea27",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3a1c35739efb69e8ec2a868113a0471a01bb8f29",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5650b013e6bfc14c8b30be727f4a715b01860a08",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/618dd640ded6b94bbdb79c798a901ec564797033",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/63110ccc434e10d9e9d2c7d82ebfa8a6f9cedd94",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/754533e6169d1f10bdef7a6ba9bd7740b524e1d4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9eaac0cb4ca94e2e32c53c156ae5b813ba7ef90c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: dw: avoid shift-out-of-bounds when DAA assigns no devices\n\nOn an empty bus ENTDAA assigns nothing, so cmd->rx_len (the count\nof addresses left unassigned) equals master->maxdevs.\n\nThe GENMASK() index master->maxdevs - cmd->rx_len - 1 then becomes -1,\nwhich trips up UBSAN. This happens every time on boot on a Gigabyte/AMD\nserver:\n\n    UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12\n    shift exponent 64 is too large for 64-bit type 'long unsigned int'\n    CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy)\n    Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32_F45 04/01/2026\n    Call Trace:\n     <TASK>\n     dump_stack_lvl+0x5d/0x80\n     ubsan_epilogue+0x5/0x2b\n     __ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab\n     dw_i3c_master_daa.cold+0x1b/0x96 [dw_i3c_master]\n     i3c_master_do_daa_ext.part.0+0x3e/0xf0 [i3c]\n\nSkip the mask when no new device was assigned."
    }
  ],
  "lastModified": "2026-09-17T17:17:37.993",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}