CVE-2026-90386: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
In the Linux kernel, the following vulnerability has been resolved:
i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
On an empty bus ENTDAA assigns nothing, so cmd->rxlen (the count of addresses left unassigned) equals master->maxdevs.
The GENMASK() index master->maxdevs - cmd->rxlen - 1 then becomes -1, which trips up UBSAN. This happens every time on boot on a Gigabyte/AMD server:
UBSAN: shift-out-of-bounds in drivers/i3c/master/dw-i3c-master.c:905:12 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 7 UID: 0 PID: 963 Comm: (udev-worker) Not tainted 7.0.11-200.fc44.x8664 #1 PREEMPT(lazy) Hardware name: Giga Computing E163-Z34-AAH1-000/MZ33-DC1-000, BIOS R32F45 04/01/2026 Call Trace: <TASK> dumpstacklvl+0x5d/0x80 ubsanepilogue+0x5/0x2b ubsanhandleshiftoutofbounds.cold+0xd7/0x1ab dwi3cmasterdaa.cold+0x1b/0x96 [dwi3cmaster] i3cmasterdodaaext.part.0+0x3e/0xf0 [i3c]
Skip the mask when no new device was assigned.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.11-200.fc44.x86_64 - Compensating control
If you cannot immediately upgrade the kernel, disable or avoid triggering i3c DAA (device address auto-assignment) on affected Gigabyte/AMD systems until the dw-i3c-master shift-out-of-bounds bug is resolved.
Event History
Frequently Asked Questions
Which systems are likely to encounter this issue?
Systems using the Linux DesignWare I3C master driver can encounter it when Dynamic Address Assignment (ENTDAA) runs on an empty I3C bus and assigns no devices. The report shows it occurring during boot on a Gigabyte/AMD server.
What condition triggers the invalid shift?
The trigger is an ENTDAA operation that leaves all possible device addresses unassigned. In that case, cmd->rx_len equals master->maxdevs, causing the mask index calculation to become -1 and resulting in a shift exponent of 64 on a 64-bit unsigned long.
How can I tell whether a system is affected?
Check kernel logs during boot or I3C device initialization for a UBSAN shift-out-of-bounds report referencing drivers/i3c/master/dw-i3c-master.c, dw_i3c_master_daa, or dw_i3c_master. The reported symptom includes a shift exponent being too large for a 64-bit long unsigned integer.
What does the available fix change?
The fix avoids generating the mask when DAA assigned no new device. This prevents the negative mask index and the resulting out-of-bounds shift.