HIGH Introduced in 6.17
i3c Transfer UAF
CVE-2026-80950
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion. The interrupt handler dequeues the transfer, updates/uses it, and signals the waiting thread. If the completion times out, the waiting thread dequeues the transfer and free it. If an interrupt fires after that, the handler may access freed memory, leading to crashes. Check that the transfer is still valid before accessing it in the interrupt handler. With it clear any status flags and disable all the interrupts to avoid triggering the same interrupts again.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability exists in the Renesas I3C driver when a transfer times out and a late interrupt accesses the already-freed transfer object. This can lead to kernel memory corruption or crashes on systems equipped with Renesas RZ/G3S or G3E SoCs. An attacker with local access to the I3C subsystem could exploit the race condition to destabilize the kernel.
Vulnerability analysis
The Renesas I3C driver prepares a transfer and waits for hardware completion via interrupt. If the operation times out, the waiting thread cleans up and frees the transfer memory, but a late interrupt may still arrive and access that freed memory, causing a use-after-free. The fix ensures that every interrupt handler first checks whether the transfer is still valid before touching it; when the transfer has already been cleaned up, the handler now disables further interrupts and clears status flags instead of using stale memory. This is reachable locally on systems using the Renesas I3C controller, and exploitation depends on winning a timing race between the timeout cleanup and a delayed hardware interrupt.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.17 | 6.18.50 | 0093f9fc102b |
| 7.2 | 6.17 | 7.2.4 | ec631aff9326 |
| mainline | 6.17 | 7.3 | 5f1a76ecfe90 |