CVE-2026-90274coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: fix underflow for usage of (nrseqstate - 1) According to IHI006H Embedded Trace Macrocell Architecture Specification[0], TRCSEQEVR<n> is implemented only when TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0 to 2; otherwise, TRCIDR5.NUMSEQSTATE is 0b000. IOW, the number of usage in the initialisation or setting TRCSEQEVR<n> with drvdata->nrseqstate - 1 in the loop could make underflow issue when TRCIDR5.NUMSEQSTATE is 0b000. Therefore, introduce nr_seq_ctrls field and untie it from nrseqstate. As part of this introduce ETM_MAX_SEQ_TRANSITIONS macro and apply nr_seq_ctrls and above macro to TRCSEQEVR<n> relevant fields setup.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2e1cdfe184b5202d51e0611d7a051e2bea303946 before 8d669db59f7283b838e029af29da12e505265fae; from 2e1cdfe184b5202d51e0611d7a051e2bea303946 before 4091f2d5b26d117c992ffcce1a5df425a0daedcd; from 2e1cdfe184b5202d51e0611d7a051e2bea303946 before be7b2de5b9a96ae68ffa3528e0a40d63e0fd8148; from 2e1cdfe184b5202d51e0611d7a051e2bea303946 before 4f9a0f548413bf864f609c9f4bc56e3f1b3577d4; 2e1cdfe184b5202d51e0611d7a051e2bea303946 builds before 1ade9a335c69fc735cb7b3f222ed35ab135540fb; from 2e1cdfe184b5202d51e0611d7a051e2bea303946 before 5ac900f73ce1d4d8308f40752b51bc8a02b244d2; from 2e1cdfe184b5202d51e0611d7a051e2bea303946 before 1674d9bff8073bdee5dbc200f56fc3caa28d0566 | CNA record |
References
- https://git.kernel.org/stable/c/8d669db59f7283b838e029af29da12e505265fae
- https://git.kernel.org/stable/c/4091f2d5b26d117c992ffcce1a5df425a0daedcd
- https://git.kernel.org/stable/c/be7b2de5b9a96ae68ffa3528e0a40d63e0fd8148
- https://git.kernel.org/stable/c/4f9a0f548413bf864f609c9f4bc56e3f1b3577d4
- https://git.kernel.org/stable/c/1ade9a335c69fc735cb7b3f222ed35ab135540fb
- https://git.kernel.org/stable/c/5ac900f73ce1d4d8308f40752b51bc8a02b244d2
- https://git.kernel.org/stable/c/1674d9bff8073bdee5dbc200f56fc3caa28d0566
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.