CVE-2026-43316
Received Received - Intake
Bounds Check Fix in Linux Kernel solo6x10 Driver

Publication date: 2026-05-08

Last updated on: 2026-05-08

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: media: solo6x10: Check for out of bounds chip_id Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type (literal "1" is an "int") could end up being shifted beyond 32 bits, so instrumentation was added (and due to the double is_tw286x() call seen via inlining), Clang decides the second one must now be undefined behavior and elides the rest of the function[1]. This is a known problem with Clang (that is still being worked on), but we can avoid the entire problem by actually checking the existing max chip ID, and now there is no runtime instrumentation added at all since everything is known to be within bounds. Additionally use an unsigned value for the shift to remove the instrumentation even without the explicit bounds checking. [hverkuil: fix checkpatch warning for is_tw286x]
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-08
Last Modified
2026-05-08
Generated
2026-05-09
AI Q&A
2026-05-08
EPSS Evaluated
N/A
NVD
CVE-2026-43316
EUVD
EUVD-2026-28600
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :

This vulnerability relates to a potential out of bounds chip_id check in the Linux kernel's media: solo6x10 driver. It involves a condition where a signed integer shift operation could lead to undefined behavior due to shifting beyond 32 bits. The issue was identified by Clang's UBSAN instrumentation and resolved by adding explicit bounds checking and using unsigned values for shifts. The impact could be related to incorrect behavior or instability in the affected driver if the issue was exploited or triggered.


Can you explain this vulnerability to me?

This vulnerability is related to the Linux kernel's media component, specifically the solo6x10 driver. It involves a potential out-of-bounds issue with the chip_id value.

The problem arises because Clang, when compiled with the CONFIG_UBSAN_SHIFT=y option, detects a situation where a signed integer (the literal "1" as an int) could be shifted beyond 32 bits, which is undefined behavior. Due to this, Clang's instrumentation causes the function to be partially elided (removed) because it treats the second call to is_tw286x() as undefined behavior.

The fix involves adding an explicit check for the maximum chip ID to ensure the shift operation stays within bounds, and changing the shift value to an unsigned type. This prevents the undefined behavior and removes the need for runtime instrumentation.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart