REDHAT-BUG-2360239: Medium severity linux/kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
ntbhwswitchtec: Fix shift-out-of-bounds in switchtecntbmwsettrans
There is a kernel API ntbmwcleartrans() would pass 0 to both addr and size. This would make xlatepos negative.
[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntbhwswitchtec.c:293:7 [ 23.734418] shift exponent -1 is negative
Ensuring xlatepos is a positive or zero before BIT.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
The issue is triggered when the ntb_mw_clear_trans() kernel API passes zero for both the address and size, causing a negative xlate_pos value that is then used as a BIT shift exponent.
How can I identify evidence that a system encountered this condition?
Affected systems may log a UBSAN shift-out-of-bounds report in drivers/ntb/hw/mscc/ntb_hw_switchtec.c, including the message "shift exponent -1 is negative." Logs may also show a Switchtec memory-window entry with address and size both set to zero.
What is the remediation described by the available information?
Apply a Linux kernel update containing the resolved ntb_hw_switchtec fix. The listed Red Hat errata are RHSA-2026:1194 and RHSA-2026:1443.