CVE-2026-90274

What it actually does

Integer underflow during initialization of TRCSEQEVR registers in the coresight etm4x driver when TRCIDR5.NUMSEQSTATE is zero, leading to invalid index calculation from (nrseqstate - 1) and potential out-of-bounds memory access or corruption.

Why it matters to the business

Kernel instability or crashes on Linux systems with affected tracing hardware, risking downtime for servers, embedded devices, and security monitoring infrastructure with low but non-zero risk of privilege escalation.

How an attack unfolds

An attacker with local access loads or initializes the etm4x driver on hardware reporting zero sequence states, triggering the underflow path during register setup loops to corrupt adjacent kernel memory structures.

How to fix it

Update to a kernel containing the fix that introduces the nr_seq_ctrls field and ETM_MAX_SEQ_TRANSITIONS macro to decouple sequence control register setup from nrseqstate.

How to confirm the fix worked

Inspect kernel source for nr_seq_ctrls usage and ETM_MAX_SEQ_TRANSITIONS macro, then confirm driver behavior on hardware with TRCIDR5.NUMSEQSTATE set to zero.

Typical attack path

1. Obtain local code execution on target Linux kernel
2. Trigger coresight etm4x driver probe or configuration path
3. Force hardware state where NUMSEQSTATE reports zero
4. Execute underflow during TRCSEQEVR setup to achieve memory corruption

How to detect it

Review kernel logs and dmesg for etm4x initialization errors, underflow warnings, or oops traces referencing sequence state register setup.

What your security team should do

• Apply the patch in all distributions using coresight etm4x tracing
• Prioritize updates on systems with ARM coresight hardware
• Monitor kernel oops and panic logs for etm4x related faults
• Disable etm4x tracing where not required until patched