GHSA-HX2C-JPPG-3C5R

Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-09-17 18:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices

On an empty bus ENTDAA assigns nothing, so cmd->rx_len (the count of addresses left unassigned) equals master->maxdevs.

The GENMASK() index master->maxdevs - cmd->rx_len - 1 then becomes -1, which trips up UBSAN. This happens every time on boot on a Gigabyte/AMD server:

UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12
shift exponent 64 is too large for 64-bit type 'long unsigned int'
CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy)
Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32_F45 04/01/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x5d/0x80
 ubsan_epilogue+0x5/0x2b
 __ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab
 dw_i3c_master_daa.cold+0x1b/0x96 [dw_i3c_master]
 i3c_master_do_daa_ext.part.0+0x3e/0xf0 [i3c]

Skip the mask when no new device was assigned.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-90386"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-17T17:17:37Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: dw: avoid shift-out-of-bounds when DAA assigns no devices\n\nOn an empty bus ENTDAA assigns nothing, so cmd-\u003erx_len (the count\nof addresses left unassigned) equals master-\u003emaxdevs.\n\nThe GENMASK() index master-\u003emaxdevs - cmd-\u003erx_len - 1 then becomes -1,\nwhich trips up UBSAN. This happens every time on boot on a Gigabyte/AMD\nserver:\n\n    UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12\n    shift exponent 64 is too large for 64-bit type \u0027long unsigned int\u0027\n    CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy)\n    Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32_F45 04/01/2026\n    Call Trace:\n     \u003cTASK\u003e\n     dump_stack_lvl+0x5d/0x80\n     ubsan_epilogue+0x5/0x2b\n     __ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab\n     dw_i3c_master_daa.cold+0x1b/0x96 [dw_i3c_master]\n     i3c_master_do_daa_ext.part.0+0x3e/0xf0 [i3c]\n\nSkip the mask when no new device was assigned.",
  "id": "GHSA-hx2c-jppg-3c5r",
  "modified": "2026-09-17T18:32:03Z",
  "published": "2026-09-17T18:32:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90386"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/038cf48b3170af26a70bf2dee4f8c3ac910f5176"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/111f559e5b6461f5f6977275716e6c5d1eb7ea27"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3a1c35739efb69e8ec2a868113a0471a01bb8f29"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5650b013e6bfc14c8b30be727f4a715b01860a08"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/618dd640ded6b94bbdb79c798a901ec564797033"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/63110ccc434e10d9e9d2c7d82ebfa8a6f9cedd94"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/754533e6169d1f10bdef7a6ba9bd7740b524e1d4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9eaac0cb4ca94e2e32c53c156ae5b813ba7ef90c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.