{"id":25795,"date":"2026-09-18T04:31:54","date_gmt":"2026-09-17T20:31:54","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90386"},"modified":"2026-09-18T04:31:54","modified_gmt":"2026-09-17T20:31:54","slug":"cve-2026-90386","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90386","title":{"rendered":"CVE-2026-90386 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: dw: avoid shift-"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices<\/p>\n<p>On an empty bus ENTDAA assigns nothing, so cmd-&gt;rx_len (the count<br \/>\nof addresses left unassigned) equals master-&gt;maxdevs.<\/p>\n<p>The GENMASK() index master-&gt;maxdevs &#8211; cmd-&gt;rx_len &#8211; 1 then becomes -1,<br \/>\nwhich trips up UBSAN. This happens every time on boot on a Gigabyte\/AMD<br \/>\nserver:<\/p>\n<p>    UBSAN: shift-out-of-bounds in drivers\/i3c\/master\/dw-i3c-master.c:905:12<br \/>\n    shift exponent 64 is too large for 64-bit type &#8216;long unsigned int&#8217;<br \/>\n    CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy)<br \/>\n    Hardware name: Giga Computing E163-Z34-AAH1-000\/MZ33-DC1-000, BIOS R32_F45 04\/01\/2026<br \/>\n    Call Trace:<\/p>\n<p>     dump_stack_lvl+0x5d\/0x80<br \/>\n     ubsan_epilogue+0x5\/0x2b<br \/>\n     __ubsan_handle_shift_out_of_bounds.cold+0xd7\/0x1ab<br \/>\n     dw_i3c_master_daa.cold+0x1b\/0x96 [dw_i3c_master]<br \/>\n     i3c_master_do_daa_ext.part.0+0x3e\/0xf0 [i3c]<\/p>\n<p>Skip the mask when no new device was assigned.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices<\/p>\n<p>On an empty bus ENTDAA assigns nothing, so cmd-&gt;rx_len (the count<br \/>\no<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25795","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25795","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25795"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25795"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25795"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}