Executive brief
The Linux kernel's i3c (Inter-Integrated Circuit) subsystem contains a race condition where device descriptor data is accessed without proper locking. An attacker with local access to i3c devices could exploit this to crash the system or potentially execute arbitrary code by causing improper memory access.
Technical details
The vulnerability exists in the i3c_device_get_supported_xfer_mode() function, which dereferences dev->desc without holding the required bus->lock. According to the i3c subsystem's locking contract, dev->desc must only be dereferenced when the bus lock is held. The function was attempting to obtain the master controller via dev->desc, but this pointer can become invalid if the device descriptor is modified or freed by another thread. The fix changes the access pattern to use dev->bus instead, which remains valid for the device's entire lifetime and does not require synchronization.
Affected products
- Linux Linux kernel multiple versions (see patch history)
Timeline
- 2026-09-11: disclosed: CVE-2026-80954 published
- 2026-08-07: patched: Fix committed upstream (commit 8bed7f4fa710914b7f05fd59998316bfb4d43385)