Cloudanix VulnDB

CVE-2026-90386

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A Linux kernel bug can cause certain servers to report errors when starting up if a specific type of hardware bus has nothing attached.

Exploitation
Other
Attacker needs
None
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Out-of-bounds shift in GENMASK calculation during I3C DAA on empty bus leads to UBSAN violation when rx_len equals maxdevs.

Why it matters to the business

Systems with specific I3C hardware may experience boot-time kernel warnings or instability on empty buses, with minimal operational disruption due to low exploitability.

How an attack unfolds

An attacker with local access or control over boot hardware triggers the empty-bus DAA path in the dw-i3c driver, causing the invalid shift; no remote vector or privilege escalation is involved.

How to fix it

Apply the upstream kernel patch that skips the mask generation when no devices are assigned during DAA; rebuild and deploy updated kernel images.

How to confirm the fix worked

Boot test system with empty I3C bus and confirm absence of UBSAN shift warnings in dmesg; verify driver source no longer reaches the invalid GENMASK line.

Typical attack path

  1. Boot system with empty I3C bus connected to dw-i3c master
  2. Kernel executes i3c_master_do_daa_ext
  3. dw_i3c_master_daa computes GENMASK with master->maxdevs - cmd->rx_len - 1 resulting in -1
  4. UBSAN reports shift-out-of-bounds

How to detect it

Inspect kernel logs for UBSAN shift-out-of-bounds messages referencing dw-i3c-master.c during early boot; correlate with hardware models known to use dw_i3c_master.

What your security team should do

  • Prioritize kernel update on affected Gigabyte/AMD server hardware within standard maintenance windows
  • Monitor dmesg for UBSAN reports during boot on I3C-enabled systems
  • Track upstream i3c driver commits for related hardening

The record

In the Linux kernel, the following vulnerability has been resolved: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA assigns nothing, so cmd->rx_len (the count of addresses left unassigned) equals master->maxdevs. The GENMASK() index master->maxdevs - cmd->rx_len - 1 then becomes -1, which trips up UBSAN. This happens every time on boot on a Gigabyte/AMD server: UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x86_64 #1 PREEMPT(lazy) Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32_F45 04/01/2026 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 ubsan_epilogue+0x5/0x2b __ubsan_handle_shift_out_of_bounds.cold+0xd7/0x1ab dw_i3c_master_daa.cold+0x1b/0x96 [dw_i3c_master] i3c_master_do_daa_ext.part.0+0x3e/0xf0 [i3c] Skip the mask when no new device was assigned.

Affected packages

Ecosystem Package Introduced Fixed