The solo6x10 media driver in the Linux kernel contains a signed integer shift that can exceed 32‑bit bounds when compiled with Clang’s UBSAN shift instrumentation. This causes undefined behavior because the shift value becomes larger than the integer width, prompting the compiler to eliminate the remainder of the function. The upstream fix adds a bounds check on the chip_id and switches the shift to use an unsigned value, thereby removing the problematic instrumentation and preventing the undefined behavior during normal operation.

All Linux kernel builds that include the solo6x10 driver and are compiled with UBSAN shift instrumentation enabled (e.g., CONFIG_UBSAN_SHIFT). Distributions shipping default kernels with UBSAN disabled are not affected, but custom kernel builds that enable UBSAN may trigger the issue.

The CVSS score of 5.5 indicates a moderate severity flaw. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. It activates only when UBSAN shift instrumentation is enabled. No public exploits have been reported. The resulting undefined behavior could lead to kernel instability in those builds, but exposure remains limited to environments that enable these checks.