CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
In the Linux kernel, the following vulnerability has been resolved:
i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
The HCI DMA dequeue path (hcidmadequeuexfer()) may be invoked for multiple transfers that timeout around the same time. However, the function is not serialized and can race with itself.
When a timeout occurs, hcidmadequeuexfer() stops the ring, processes incomplete transfers, and then restarts the ring. If another timeout triggers a parallel call into the same function, the two instances may interfere with each other - stopping or restarting the ring at unexpected times.
Add a mutex so that hcidmadequeuexfer() is serialized with respect to itself.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1035.38 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.10-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.19 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.9 - Configuration
Add a mutex so that hci_dma_dequeue_xfer() is serialized with respect to itself, preventing concurrent timeout-triggered calls from stopping or restarting the DMA ring unexpectedly.
Linux kernel i3c mipi-i3c-hci DMA ring dequeue hci_dma_dequeue_xfer() serialization = mutex
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43353?
CVE-2026-43353 has been classified with a medium severity level.
How do I fix CVE-2026-43353?
To fix CVE-2026-43353, update your Linux kernel to the latest version that includes the patch for the i3c DMA race condition.
What systems are affected by CVE-2026-43353?
CVE-2026-43353 affects the Linux mipi-i3c-hci driver in the Linux kernel.
What is the nature of the vulnerability in CVE-2026-43353?
CVE-2026-43353 is a race condition vulnerability in the DMA dequeue path of the i3c driver.
Can CVE-2026-43353 lead to data loss?
Yes, CVE-2026-43353 may result in unstable behavior that can lead to data loss during DMA transfers.