CVE-2026-90386 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
On an empty bus ENTDAA assigns nothing, so cmd->rx_len (the count of addresses left unassigned) equals master->maxdevs.
The GENMASK() index master->maxdevs - cmd->rx_len - 1 then becomes -1, which trips up UBSAN. This happens every time on boot on a Gigabyte/AMD server:
UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy) Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32_F45 04/01/2026 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ubsan_epilogue+0x5/0x2b __ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab dw_i3c_master_daa.cold+0x1b/0x96 [dw_i3c_master]
i3c_master_do_daa_ext.part.0+0x3e/0xf0 [i3c]
Skip the mask when no new device was assigned.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's Inter-Integrated Circuit (I2C) Controller driver for DesignWare, specifically within the Dynamic Address Assignment mechanism, contained a critical integer underflow vulnerability that triggered undefined behavior during system initialization on certain hardware platforms. This flaw manifests when the I3C bus is empty and no devices are present to be assigned addresses by the host controller. During the boot process, particularly in environments such as Gigabyte AMD servers running kernel version 7.0.11-200.fc44.x86_64, the driver attempts to calculate a bitmask representing unassigned device slots using the GENMASK macro. The calculation involves subtracting the count of addresses left unassigned from the maximum number of supported devices and then subtracting one more index value. When no new devices are assigned because the bus is empty, the variable tracking remaining assignments equals the total capacity, causing the resulting index to evaluate to negative one.
This negative index leads directly to a shift-out-of-bounds error detected by the Undefined Behavior Sanitizer (UBSAN). Specifically, the GENMASK macro attempts to perform a bitwise operation with an exponent of sixty-four on a sixty-four-bit unsigned integer type. In C programming standards and kernel development practices, shifting by a value greater than or equal to the width of the data type is undefined behavior that can lead to unpredictable results, including potential security implications if exploited in other contexts, though here it primarily causes immediate runtime errors and log spam during boot. The vulnerability stems from insufficient boundary checking before performing arithmetic operations on device count variables without verifying that a valid range exists for mask generation.
From a classification perspective, this issue aligns with CWE-190 Integer Overflow or Wraparound, as the subtraction operation results in an underflow condition when dealing with unsigned integers implicitly cast to signed contexts or handled incorrectly by macro expansions expecting positive indices. Furthermore, it relates to CWE-682 Incorrect Calculation due to improper handling of edge cases where input data leads to invalid state transitions within driver logic. The operational impact includes system instability during early boot phases and excessive kernel logging that may obscure other critical warnings. While the immediate effect is a sanitizer violation rather than arbitrary code execution, such bugs often indicate deeper logical flaws in how hardware resources are managed and validated before use.
To mitigate this vulnerability, developers must implement explicit checks to ensure that device assignment operations only proceed when there are actual devices present on the bus or when valid indices can be derived for mask generation. The fix involves skipping the mask calculation entirely if no new devices were assigned during the Dynamic Address Assignment phase. This prevents the execution of invalid bitwise shifts and ensures robust handling of empty bus scenarios. System administrators should apply kernel updates that include this patch to restore stable boot processes on affected hardware configurations, thereby eliminating UBSAN warnings and ensuring compliance with secure coding standards for embedded controller drivers in Linux systems.