Executive brief
The Linux kernel's i3c DesignWare master driver contains an arithmetic error in device address assignment (DAA) that triggers a crash when initializing an empty i3c bus. This causes boot failures on affected servers during device enumeration, resulting in system unavailability until the issue is patched.
Technical details
A shift-out-of-bounds vulnerability exists in drivers/i3c/master/dw-i3c-master.c when processing an empty i3c bus during ENTDAA (enter dynamic address assignment). When no devices are assigned, cmd->rx_len equals master->maxdevs, causing the index in GENMASK(master->maxdevs - cmd->rx_len - 1, 0) to become -1, triggering UBSAN (Undefined Behavior Sanitizer). This occurs during kernel boot on systems with empty i3c buses, manifesting as a kernel crash. The fix adds a conditional check to skip the GENMASK operation when cmd->rx_len >= master->maxdevs, setting newdevs to 0 instead. Patches are available in the Linux stable tree.
Affected products
- Linux Linux Kernel 5.0 and later (specific versions affected include 7.0.11, but vulnerability present in earlier stable branches)
Timeline
- 2026-09-17: disclosed
- 2026-06-30: patched: Original fix committed upstream
- 2026-09-14: patched: Backported to stable kernels