Executive brief
A locking issue in the Linux kernel's i3c (Inter-Integrated Circuit) bus master code can cause a deadlock when registering newly discovered devices. When device drivers initialize during registration, they may attempt to re-acquire a lock that is already held, causing the system to hang and disrupting I3C-based hardware communication.
Technical details
The vulnerability is a recursive read-lock deadlock in i3c_master_register_new_i3c_devs(). The function holds i3c_bus_normaluse_lock (a read-write semaphore) while calling device_register(), which immediately triggers device probe callbacks. These callbacks typically invoke I3C helper functions that attempt to acquire the same rwsem again. Since rwsems do not support recursive read locking, this causes a deadlock when a writer is waiting on the lock. The fix separates device creation from registration: device objects are populated under the maintenance lock, collected in a temporary list, the lock is released, device_register() is called outside the lock, and the maintenance lock is retaken for cleanup if needed.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-17: disclosed