Executive brief
A vulnerability in the Linux kernel's I3C driver could allow a local user to disrupt system operations or potentially access sensitive information. The issue stems from how the system handles data transfer cancellations, which can lead to hardware instability or memory corruption. This could result in system crashes or unauthorized data access on devices using I3C communication interfaces.
Technical details
A vulnerability in the mipi-i3c-hci driver's DMA dequeue logic (hci_dma_dequeue_xfer) stems from multiple flaws in RING_CTRL_ABORT handling. Specifically, the driver unconditionally issued aborts even on stopped rings, failed to re-initialize completion primitives, and unintentionally cleared the RING_CTRL_ENABLE bit, which resets hardware ring pointers. These issues can lead to a state where the hardware continues writing to memory after the driver expects it to stop, potentially causing memory corruption or a kernel panic. An attacker with local access could exploit these synchronization and state management flaws to compromise system integrity or availability. Patches have been released to ensure the ring status is checked before aborting and that control bits are maintained correctly.
Affected products
- Linux Linux Kernel 9ad9a52cce282 to fixed versions
Timeline
- 2026-03-06: other: Patch authored
- 2026-05-08: disclosed: CVE published