-

CVE-2026-90386

i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices

In the Linux kernel, the following vulnerability has been resolved:

i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices

On an empty bus ENTDAA assigns nothing, so cmd->rx_len (the count
of addresses left unassigned) equals master->maxdevs.

The GENMASK() index master->maxdevs - cmd->rx_len - 1 then becomes -1,
which trips up UBSAN. This happens every time on boot on a Gigabyte/AMD
server:

    UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12
    shift exponent 64 is too large for 64-bit type 'long unsigned int'
    CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy)
    Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32_F45 04/01/2026
    Call Trace:
     <TASK>
     dump_stack_lvl+0x5d/0x80
     ubsan_epilogue+0x5/0x2b
     __ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab
     dw_i3c_master_daa.cold+0x1b/0x96 [dw_i3c_master]
     i3c_master_do_daa_ext.part.0+0x3e/0xf0 [i3c]

Skip the mask when no new device was assigned.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef
Version < 5650b013e6bfc14c8b30be727f4a715b01860a08
Status affected
Version 1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef
Version < 63110ccc434e10d9e9d2c7d82ebfa8a6f9cedd94
Status affected
Version 1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef
Version < 3a1c35739efb69e8ec2a868113a0471a01bb8f29
Status affected
Version 1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef
Version < 111f559e5b6461f5f6977275716e6c5d1eb7ea27
Status affected
Version 1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef
Version < 754533e6169d1f10bdef7a6ba9bd7740b524e1d4
Status affected
Version 1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef
Version < 9eaac0cb4ca94e2e32c53c156ae5b813ba7ef90c
Status affected
Version 1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef
Version < 618dd640ded6b94bbdb79c798a901ec564797033
Status affected
Version 1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef
Version < 038cf48b3170af26a70bf2dee4f8c3ac910f5176
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 5.0
Status affected
Version 0
Version < 5.0
Status unaffected
Version <= 5.10.*
Version 5.10.270
Status unaffected
Version <= 5.15.*
Version 5.15.221
Status unaffected
Version <= 6.1.*
Version 6.1.188
Status unaffected
Version <= 6.6.*
Version 6.6.157
Status unaffected
Version <= 6.12.*
Version 6.12.110
Status unaffected
Version <= 6.18.*
Version 6.18.52
Status unaffected
Version <= 7.2.*
Version 7.2.6
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.117
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/5650b013e6bfc14c8b30be727f4a715b01860a08
https://git.kernel.org/stable/c/63110ccc434e10d9e9d2c7d82ebfa8a6f9cedd94
https://git.kernel.org/stable/c/3a1c35739efb69e8ec2a868113a0471a01bb8f29
https://git.kernel.org/stable/c/111f559e5b6461f5f6977275716e6c5d1eb7ea27
https://git.kernel.org/stable/c/754533e6169d1f10bdef7a6ba9bd7740b524e1d4
https://git.kernel.org/stable/c/9eaac0cb4ca94e2e32c53c156ae5b813ba7ef90c
https://git.kernel.org/stable/c/618dd640ded6b94bbdb79c798a901ec564797033
https://git.kernel.org/stable/c/038cf48b3170af26a70bf2dee4f8c3ac910f5176