Executive brief
A vulnerability was identified in the Linux kernel's I3C driver, which manages high-speed communication between a computer's processor and peripheral sensors or devices. A flaw in how the system handles multiple simultaneous data transfer timeouts could allow a local attacker to cause system instability or potentially gain unauthorized access to sensitive information. This issue primarily impacts the reliability and security of devices using MIPI I3C hardware interfaces.
Technical details
A race condition exists in the mipi-i3c-hci driver within the hci_dma_dequeue_xfer() function. The function, which handles DMA transfer dequeuing during timeouts, lacks proper serialization. When multiple transfers timeout simultaneously, parallel executions of this function can interfere with each other while stopping and restarting the DMA ring, leading to unpredictable hardware states. An attacker with local access could exploit this race to cause a denial of service or potentially achieve elevated privileges/data access. The fix introduces a mutex to ensure that the dequeue path is properly serialized.
Affected products
- Linux Linux Kernel Introduced in 9ad9a52cce282; fixed in various stable branches
Timeline
- 2026-03-06: disclosed: Initial patch submitted by Adrian Hunter
- 2026-05-08: advisory: CVE-2026-43353 published by kernel.org