Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90274— coresight: etm4x: fix underflow for usage of (nrseqstate - 1)

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已解决以下漏洞： coresight: etm4x：修复 (nrseqstate - 1) 用法中的下溢问题 根据 IHI006H《嵌入式跟踪宏单元架构规范》[0]，TRCSEQEVR<n> 仅在 TRCIDR5.NUMSEQSTATE 为 0b100 时才被实现，此时 n 的取值范围为 0 到 2；否则，TRCIDR5.NUMSEQSTATE 应为 0b000。 换言之，在初始化或配置 TRCSEQEVR<n> 时，若在循环中使用 drvdata->nrseqstate - 1 作为使用次

AI Predicted 5.5 Difficulty: Hard EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1204 · User Execution

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 2e1cdfe184b5202d51e0611d7a051e2bea303946< 8d669db59f7283b838e029af29da12e505265fae affected
2e1cdfe184b5202d51e0611d7a051e2bea303946< 4091f2d5b26d117c992ffcce1a5df425a0daedcd affected
2e1cdfe184b5202d51e0611d7a051e2bea303946< be7b2de5b9a96ae68ffa3528e0a40d63e0fd8148 affected
2e1cdfe184b5202d51e0611d7a051e2bea303946< 4f9a0f548413bf864f609c9f4bc56e3f1b3577d4 affected
2e1cdfe184b5202d51e0611d7a051e2bea303946< 1ade9a335c69fc735cb7b3f222ed35ab135540fb affected
2e1cdfe184b5202d51e0611d7a051e2bea303946< 5ac900f73ce1d4d8308f40752b51bc8a02b244d2 affected
2e1cdfe184b5202d51e0611d7a051e2bea303946< 1674d9bff8073bdee5dbc200f56fc3caa28d0566 affected
4.2 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90274

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: fix underflow for usage of (nrseqstate - 1) According to IHI006H Embedded Trace Macrocell Architecture Specification[0], TRCSEQEVR<n> is implemented only when TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0 to 2; otherwise, TRCIDR5.NUMSEQSTATE is 0b000. IOW, the number of usage in the initialisation or setting TRCSEQEVR<n> with drvdata->nrseqstate - 1 in the loop could make underflow issue when TRCIDR5.NUMSEQSTATE is 0b000. Therefore, introduce nr_seq_ctrls field and untie it from nrseqstate. As part of this introduce ETM_MAX_SEQ_TRANSITIONS macro and apply nr_seq_ctrls and above macro to TRCSEQEVR<n> relevant fields setup.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 2e1cdfe184b5202d51e0611d7a051e2bea303946 ~ 8d669db59f7283b838e029af29da12e505265fae -
Linux Linux 4.2 -

II. Public POCs for CVE-2026-90274

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90274

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90274 (6)

Same Patch Batch · Linux · 2026-09-17 · 600 CVEs total

CVE-2026-92489 9.8 CRITICAL xfrm: Fix skb double-free in xfrm_dev_direct_output()
CVE-2026-90104 9.8 CRITICAL NFSv4.1: zero referring call lists before decoding
CVE-2026-90235 9.8 CRITICAL sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
CVE-2026-90173 9.8 CRITICAL smb: smbdirect: free completion queues with ib_free_cq()
CVE-2026-90151 9.8 CRITICAL NFSv4: remove callback IDR entry on client allocation failure
CVE-2026-90110 9.4 CRITICAL inetpeer: randomize RB-tree node comparison using SipHash
CVE-2026-90413 9.1 CRITICAL IB/isert: reject login PDUs declaring more data than was received
CVE-2026-90414 9.1 CRITICAL IB/isert: reject PDUs declaring more data than was received
CVE-2026-90230 9.1 CRITICAL nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
CVE-2026-90256 8.8 HIGH Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
CVE-2026-90357 8.8 HIGH wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
CVE-2026-90286 8.8 HIGH drm/amdgpu/gfx6: Use PFP on the compute queues too
CVE-2026-90381 8.8 HIGH wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
CVE-2026-90380 8.8 HIGH wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
CVE-2026-90329 8.8 HIGH HID: synchronize input before cleaning up a failed probe
CVE-2026-93042 8.8 HIGH dmaengine: dw-edma: Terminate all descriptors without callbacks
CVE-2026-90162 8.8 HIGH ksmbd: defer publishing granted locks to prevent UAF/double-free race
CVE-2026-90379 8.8 HIGH wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
CVE-2026-90367 8.8 HIGH wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
CVE-2026-90371 8.8 HIGH wifi: mt76: fix RXDMAD_C buffer recycling race

Showing top 20 of 600 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90274

No comments yet

Leave a comment