HIGH Introduced in 6.19
i3c XferMode Race
CVE-2026-80954
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() i3c_device_get_supported_xfer_mode() uses dev->desc to obtain the master controller. However, dev->desc must not be dereferenced unless bus->lock is held, and this function does not take that lock. The function only needs access to the master controller associated with the device's bus. Use dev->bus instead, which is always valid for the lifetime of the device and does not require dereferencing dev->desc.
02KernelScan AI Analysis
Risk summary
An unlocked dereference in the I3C transfer-mode query can race with bus teardown, causing a use-after-free. Local access with control over I3C device operations is needed; the flaw can potentially lead to information disclosure, data corruption, or a kernel panic.
Vulnerability analysis
A function that queries an I3C device for its supported transfer modes accesses an object without holding the lock that protects that object's lifetime. If the bus is torn down concurrently, the object can be freed while still being accessed, leading to a use-after-free. The fix obtains the needed information through a different reference that remains valid for the entire lifetime of the device, eliminating the unsafe access. The issue can be triggered locally by any code that interacts with I3C devices.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.19 | 7.2.4 | 251db58324ea |
| mainline | 6.19 | 7.3 | 8bed7f4fa710 |