CVE-2026-80953: i3c: master: adi: initialize the lock before enabling interrupts
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: adi: initialize the lock before enabling interrupts
adii3cmasterprobe() requests the IRQ and unmasks REGIRQPENDINGCMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A pending CMDR interrupt can therefore run adii3cmasterirq() and take master->xferqueue.lock before the dynamic lock has been initialized.
This issue was found by our static analysis tool and then manually reviewed against the current tree.
The grounded PoC kept the probe ordering and the IRQ path adii3cmasterprobe() -> adii3cmasterirq() -> xferqueue.lock, with a pending CMDR interrupt arriving after REGIRQPENDINGCMDR is unmasked. Lockdep reported:
INFO: trying to register non-static key. you didn't initialize this object before use? lockacquire+0xbb/0x290 rawspinlockirqsave+0x36/0x60 adii3cmasterirq+0x32/0x56 [vulnmsv] adii3cmasterprobe+0x5a/0xf47 [vulnmsv]
Initialize the transfer queue and IBI state before requesting and unmasking the IRQ.
Affected Software
Event History
Frequently Asked Questions
Under what condition can this race occur?
The ADI I3C master controller must have a pending CMDR interrupt when the driver probe path unmasks REG_IRQ_PENDING_CMDR. The interrupt can then execute before the driver's transfer queue lock and IBI state have been initialized.
What is the practical impact of triggering the issue?
The IRQ handler may attempt to acquire an uninitialized dynamic transfer-queue lock. The reported reproducer triggered a Lockdep warning about registering a non-static key before initialization.
What should be done if patching cannot be applied immediately?
The provided information identifies the unsafe condition as enabling and unmasking the IRQ before initialization completes. No supported runtime mitigation or configuration workaround is provided.
How can administrators identify a potentially affected system?
Look for Lockdep messages such as "trying to register non-static key" with a stack involving adi_i3c_master_irq(), _raw_spin_lock_irqsave(), and adi_i3c_master_probe(). The issue is associated with the ADI I3C master driver probe and a pending CMDR interrupt.