CVE-2026-72454: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()
In the Linux kernel, the following vulnerability has been resolved:
i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev()
i3chciaddrtodev() walks bus->devs.i3c, which is protected by bus.lock (rwsem). However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent device addition/removal in the I3C core to modify the list while it is being traversed, potentially leading to use-after-free or crashes.
Remove the dependency on the bus device list and introduce a dedicated lookup table. Add an ibidevs[] array indexed by DAT entry, maintained under hci->lock. Update the array when IBIs are enabled or disabled, so that it always reflects the set of devices allowed to generate IBIs. Also update when IBIs are freed, to cover the corner case when an IBI is freed without first being disabled (e.g. oldedev in i3cmasteraddi3cdevlocked()).
Move i3chciaddrtodev() into core.c, reimplement it using the new array, and add a lockdep assertion to enforce that hci->lock is held by callers.
Demote a message in PIO and DMA IBI handling, from an error to a debug message, because there is a race window when the condition can arise normally.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1035.38 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In the Linux kernel MIPI I3C HCI implementation, add a dedicated ibi_devs[] lookup array indexed by DAT entry, maintain it under hci->lock, and update it when IBIs are enabled, disabled, or freed (including IBIs freed without first being disabled).
- Compensating control
Move i3c_hci_addr_to_dev() into core.c and implement it using ibi_devs[] rather than bus->devs.i3c; require callers to hold hci->lock with a lockdep assertion.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72454?
The severity of CVE-2026-72454 is rated as 37.
What does CVE-2026-72454 impact?
CVE-2026-72454 impacts the Linux kernel's MIPI I3C HCI due to a race condition in the i3c_hci_addr_to_dev() function.
How do I fix CVE-2026-72454?
To fix CVE-2026-72454, update the Linux kernel to the patched version that addresses the race condition in the affected function.
What is the main issue in CVE-2026-72454?
The main issue in CVE-2026-72454 is a race condition that occurs when accessing bus devices without proper locking.
Who can be affected by CVE-2026-72454?
Users and systems that rely on the Linux kernel's MIPI I3C HCI functionality may be affected by CVE-2026-72454.