CVE-2026-90386

A flaw was found in the Linux kernel's I3C (Improved Inter-Integrated Circuit) dw driver. When the system attempts to assign dynamic addresses on an empty I3C bus, a calculation error leads to a 'shift-out-of-bounds' condition. This can cause the system to crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as having a Low impact because exploitation requires local access and specialized hardware configured with a DesignWare I3C controller connected to an empty bus. Standard server and virtualized environments lack this specific hardware configuration and are consequently unaffected. In addition, earlier enterprise releases, including Red Hat Enterprise Linux 8 and 9, do not include the affected driver code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.