Executive brief
The ADI I3C controller driver in the Linux kernel enabled interrupts before initializing the locks protecting its transfer queue, creating a race condition. If a pending interrupt arrived during probe, it could attempt to acquire an uninitialized spinlock, causing a kernel panic or undefined behavior. This affects systems using the ADI I3C master controller.
Technical details
This is a lock initialization order vulnerability (CWE-667) in the adi_i3c_master_probe() function. The probe routine requested an IRQ and unmasked REG_IRQ_PENDING_CMDR before initializing the transfer queue spinlock (master->xferqueue.lock) and IBI state. A pending CMDR interrupt could fire during this window and call adi_i3c_master_irq(), which attempts to acquire the uninitialized lock. The attack requires a hardware device with a pending interrupt at probe time (no user interaction needed). The fix reorders initialization so spin_lock_init(&master->xferqueue.lock) and IBI state setup occur before IRQ registration and unmasking. Patches are available in upstream Linux and stable branches.
Affected products
- Linux Linux kernel multiple versions (via a79ac2cdc91d onwards until patched)
Timeline
- 2026-09-11: disclosed: CVE-2026-80953 published
- 2026-07-31: patched: Upstream fix merged (commit 8a53f9102a0d)
- 2026-09-07: patched: Backported to stable trees