Executive brief
The I3C IBI (In-Band Interrupt) subsystem in Zephyr manages a pool of work nodes used to process interrupt requests from I3C bus devices. An unprotected free-list allows race conditions when allocating and returning work nodes, which could lead to memory corruption or system crashes. An attacker with physical access to an I3C bus device could exploit this by generating carefully-timed interrupts, though practical exploitation is difficult and impact is primarily denial of service.
Technical details
The vulnerability is a use-after-free and double-free race condition in drivers/i3c/i3c_ibi_workq.c. The i3c_ibi_work_nodes_free free-list uses a plain sys_slist_t with no synchronization, and list operations (sys_slist_get() and sys_slist_append()) are neither atomic nor interrupt-safe. Allocation helpers called from ISR context race against the workqueue thread returning nodes, corrupting the list linkage and allowing a single node to be handed out twice or lost entirely. When a node is double-handed-out, the subsequent memcpy() can overwrite active node data or write out-of-bounds with a garbage pointer. The attack vector requires physical access to the I3C bus and precise timing to collide interrupts with list operations. The fix adds ibi_work_alloc()/ibi_work_free() helpers with spinlock protection (ibi_work_lock) to serialize all free-list access across ISR and thread contexts.
Affected products
- Zephyr Zephyr OS <unknown; patch released 2026-08-31
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fix implemented with spinlock-protected allocation helpers