Not yet scoredPublished Sep 17, 2026

CVE-2026-90274coresight: etm4x: fix underflow for usage of (nrseqstate - 1)

Updated under an hour ago (Oct 26, 2026, 9:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: fix underflow for usage of (nrseqstate - 1) According to IHI006H Embedded Trace Macrocell Architecture Specification[0], TRCSEQEVR<n> is implemented only when TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0 to 2; otherwise, TRCIDR5.NUMSEQSTATE is 0b000. IOW, the number of usage in the initialisation or setting TRCSEQEVR<n> with drvdata->nrseqstate - 1 in the loop could make underflow issue when TRCIDR5.NUMSEQSTATE is 0b000. Therefore, introduce nr_seq_ctrls field and untie it from nrseqstate. As part of this introduce ETM_MAX_SEQ_TRANSITIONS macro and apply nr_seq_ctrls and above macro to TRCSEQEVR<n> relevant fields setup.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2e1cdfe184b5202d51e0611d7a051e2bea303946 before 8d669db59f7283b838e029af29da12e505265fae; from 2e1cdfe184b5202d51e0611d7a051e2bea303946 before 4091f2d5b26d117c992ffcce1a5df425a0daedcd; from 2e1cdfe184b5202d51e0611d7a051e2bea303946 before be7b2de5b9a96ae68ffa3528e0a40d63e0fd8148; from 2e1cdfe184b5202d51e0611d7a051e2bea303946 before 4f9a0f548413bf864f609c9f4bc56e3f1b3577d4; 2e1cdfe184b5202d51e0611d7a051e2bea303946 builds before 1ade9a335c69fc735cb7b3f222ed35ab135540fb; from 2e1cdfe184b5202d51e0611d7a051e2bea303946 before 5ac900f73ce1d4d8308f40752b51bc8a02b244d2; from 2e1cdfe184b5202d51e0611d7a051e2bea303946 before 1674d9bff8073bdee5dbc200f56fc3caa28d0566	CNA record

References

References

https://git.kernel.org/stable/c/8d669db59f7283b838e029af29da12e505265fae
https://git.kernel.org/stable/c/4091f2d5b26d117c992ffcce1a5df425a0daedcd
https://git.kernel.org/stable/c/be7b2de5b9a96ae68ffa3528e0a40d63e0fd8148
https://git.kernel.org/stable/c/4f9a0f548413bf864f609c9f4bc56e3f1b3577d4
https://git.kernel.org/stable/c/1ade9a335c69fc735cb7b3f222ed35ab135540fb
https://git.kernel.org/stable/c/5ac900f73ce1d4d8308f40752b51bc8a02b244d2
https://git.kernel.org/stable/c/1674d9bff8073bdee5dbc200f56fc3caa28d0566

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.