HIGH Introduced in 4.2
coresight etm4x Underflow
CVE-2026-90274
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: fix underflow for usage of (nrseqstate - 1) According to IHI006H Embedded Trace Macrocell Architecture Specification[0], TRCSEQEVR<n> is implemented only when TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0 to 2; otherwise, TRCIDR5.NUMSEQSTATE is 0b000. IOW, the number of usage in the initialisation or setting TRCSEQEVR<n> with drvdata->nrseqstate - 1 in the loop could make underflow issue when TRCIDR5.NUMSEQSTATE is 0b000. Therefore, introduce nr_seq_ctrls field and untie it from nrseqstate. As part of this introduce ETM_MAX_SEQ_TRANSITIONS macro and apply nr_seq_ctrls and above macro to TRCSEQEVR<n> relevant fields setup.
02KernelScan AI Analysis
Risk summary
A local user with access to CoreSight ETM4x tracing interfaces can trigger an integer underflow in the sequencer state control register initialization loop, causing out-of-bounds memory access. This can lead to kernel instability or denial of service on systems with ARM CoreSight ETM4x hardware.
Vulnerability analysis
When the underlying trace hardware reports that it has no sequencer states, the driver subtracts one from that count to set up a loop. Because the count is stored in a small integer type, this subtraction wraps around to a very large number, causing the loop to run far too many times. Each iteration accesses the next element in a small array of sequencer settings, so the loop dramatically overruns the array boundary, reading from and writing to adjacent kernel memory. The corrected driver keeps the number of transition controls separate from the hardware state count, only populating it when the hardware actually supports sequencer states, and uses that dedicated count to bound the loop. A local user who can access the ARM CoreSight tracing interface can trigger the overrun; this requires the driver to be present on a system with the relevant hardware.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 4.2 | 6.1.188 | 4091f2d5b26d |
| 6.6 | 4.2 | 6.6.157 | be7b2de5b9a9 |
| 6.18 | 4.2 | 6.18.52 | 1ade9a335c69 |
| 7.2 | 4.2 | 7.2.6 | 5ac900f73ce1 |
| mainline | 4.2 | 7.3-rc1 | 1674d9bff807 |
| 6.12 | 4.2 | 6.12.110 | 4f9a0f548413 |
| 5.15 | 4.2 | 5.15.221 | 8d669db59f72 |
| cip/6.12 | 4.2 | 6.12.111-cip32 | 4f9a0f548413 |