CVE-2026-80954: i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode()
In the Linux kernel, the following vulnerability has been resolved:
i3c: Fix unlocked dereference of dev->desc in i3cdevicegetsupportedxfermode()
i3cdevicegetsupportedxfermode() uses dev->desc to obtain the master controller. However, dev->desc must not be dereferenced unless bus->lock is held, and this function does not take that lock.
The function only needs access to the master controller associated with the device's bus. Use dev->bus instead, which is always valid for the lifetime of the device and does not require dereferencing dev->desc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In i3c_device_get_supported_xfer_mode(), use dev->bus instead of dereferencing dev->desc to obtain the master controller, because dev->desc requires bus->lock while dev->bus remains valid for the device lifetime.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel I3C subsystem are relevant. The issue is in i3c_device_get_supported_xfer_mode(), where the device descriptor can be dereferenced without holding the required bus lock.
What condition triggers the unsafe access?
The condition occurs when i3c_device_get_supported_xfer_mode() accesses dev->desc to locate the master controller without bus->lock being held. The descriptor is not safe to dereference under those conditions.
How is the issue addressed?
The fix obtains the master controller through dev->bus rather than dev->desc. dev->bus remains valid for the lifetime of the device and does not require dereferencing the descriptor or taking the bus lock.