CVE-2026-80950: i3c: renesas: Check that the transfer is valid before accessing it
In the Linux kernel, the following vulnerability has been resolved:
i3c: renesas: Check that the transfer is valid before accessing it
The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt handler dequeues the transfer, updates/uses it, and signals the waiting thread.
If the completion times out, the waiting thread dequeues the transfer and free it. If an interrupt fires after that, the handler may access freed memory, leading to crashes.
Check that the transfer is still valid before accessing it in the interrupt handler. With it clear any status flags and disable all the interrupts to avoid triggering the same interrupts again.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel Renesas I3C driver are exposed when they perform asynchronous I3C transfers. The issue involves the driver's interrupt handler accessing a transfer after the waiting thread has timed out, removed it from the queue, and freed it.
What conditions are needed to trigger the crash?
An I3C transfer must time out, causing its transfer structure to be dequeued and freed, and an interrupt must then fire afterward. The interrupt handler can then access the freed transfer memory, which may cause a crash.
How can I determine whether a system may already be affected?
Investigate crashes involving the Renesas I3C driver, particularly around timed-out I3C transfers and subsequent interrupts. The described failure mode is a use-after-free in the driver's interrupt handling path.
What does the fix change?
The fix validates that a transfer is still valid before the interrupt handler accesses it. When no valid transfer remains, it clears status flags and disables interrupts to prevent the same interrupts from firing again.