Executive brief
The Linux kernel's MIPI I3C Host Controller Interface driver contains a race condition in the device address lookup function that is called from interrupt handlers. When devices are concurrently added or removed from the I3C bus, the lookup function can access freed memory or crash while traversing an unprotected device list. This vulnerability could allow an attacker with physical access or the ability to trigger device hotplug events to cause a kernel crash or data corruption.
Technical details
The vulnerability is a classic race condition (CWE-362) in the `i3c_hci_addr_to_dev()` function within the MIPI I3C HCI driver. The function traverses the bus device list (`bus->devs.i3c`) while protected by `bus.lock` (a read-write semaphore), but it is called from the MIPI I3C HCI IRQ handler context, which cannot acquire the semaphore. Concurrent device addition/removal in the I3C core can modify the list during traversal, leading to use-after-free or NULL pointer dereference. The fix introduces a dedicated `ibi_devs[]` array indexed by DAT (Device Address Table) entry and protected by `hci->lock` (a spinlock suitable for IRQ contexts), eliminating the dependency on the unprotected bus device list. The array is maintained when IBIs (In-Band Interrupts) are enabled, disabled, or freed. Patch availability: Fix included in Linux kernel stable trees (commit 650716f23eac488c6696babdc7805f6a6b7427ad and backported to multiple stable branches).
Affected products
- Linux Linux kernel Various (affects MIPI I3C HCI driver in stable branches from 5.x through 7.x)
Timeline
- 2026-08-15: disclosed
- 2026-06-12: patched: Fix committed upstream
- 2026-07-24: patched: Backported to stable kernels via Sasha Levin