UBUNTU-CVE-2026-80950: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt handler dequeues the transfer, updates/uses it, and signals the waiting thread. If the completion times out, the waiting thread dequeues the transfer and free it. If an interrupt fires after that, the handler may access freed memory, leading to crashes. Check that the transfer is still valid before accessing it in the interrupt handler. With it clear any status flags and disable all the interrupts to avoid triggering the same interrupts again.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Renesas I3C driver interrupt handler, verify that the transfer is still valid before accessing it; clear all status flags and disable all interrupts to prevent retriggering.
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems running one of the listed Ubuntu kernel packages and using the Renesas I3C driver are the relevant population. The issue is in asynchronous I3C transfer handling, so systems without that driver or hardware path in use are not described as exposed by the available data.
What does an attacker need to exploit it?
The severity vector indicates local access, low attack complexity, low privileges, and no user interaction. The description does not identify a specific user-facing trigger or required I3C device condition.
What is the impact if the race occurs?
An interrupt handler can access a transfer structure after the waiting thread has removed and freed it following a timeout. This use-after-free condition can cause crashes; the supplied severity vector also rates confidentiality, integrity, and availability impact as high.
What does the fix change?
The fix validates that a transfer remains valid before the interrupt handler accesses it. When it is no longer valid, it clears status flags and disables interrupts to prevent the same interrupts from firing again.