Executive brief
The Linux kernel's Coresight ETM4x driver, which provides hardware-based execution tracing for debugging and performance analysis, contains an integer underflow vulnerability in sequencer state control initialization. When certain hardware register values indicate no sequencer states are implemented, subtracting 1 from a counter can underflow, potentially leading to out-of-bounds memory access or incorrect trace hardware configuration.
Technical details
The vulnerability is an integer underflow (CWE-191) in the Coresight ETM4x driver's sequencer state initialization code. The root cause is that code attempted to use `nrseqstate - 1` in a loop condition without validating that `nrseqstate` is non-zero first. When the TRCIDR5.NUMSEQSTATE field is 0b000 (indicating no sequencer states), subtracting 1 causes an underflow. The fix introduces a separate `nr_seq_ctrls` field and an `ETM_MAX_SEQ_TRANSITIONS` macro to decouple sequencer state count from sequencer control register count, ensuring the loop only runs when sequencer states are actually implemented. This is a kernel-level code fix with no special preconditions; affected systems run vulnerable kernel versions on hardware with this tracing capability.
Affected products
- Linux Linux kernel affected versions not fully specified in advisory; fixed in commit 1674d9bff8073bdee5dbc200f56fc3caa28d0566
Timeline
- 2026-09-17: disclosed
- 2026-08-07: patched: upstream fix committed