UBUNTU-CVE-2026-97515: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 On NPCM845, when a target on the I3C bus gets stuck holding SDA low, the controller reports a false Master Request (MR) in-band interrupt event. The driver handles this by emitting a STOP condition to restore the bus. However, the hardware quirk SVCI3CQUIRKFALSESLVSTART indicates that emitting a STOP condition may spuriously set the SLVSTART interrupt status bit. In the Master Request case, this creates a feedback loop: the STOP triggers a new SLVSTART event, the IRQ handler fires again, the controller still reports an MR type, another STOP is emitted, and the cycle repeats indefinitely, resulting in an IRQ storm that can lock up the CPU. Clear the SLVSTART status bit explicitly after emitting the STOP in the Master Request IBI handler when the SVCI3CQUIRKFALSESLVSTART quirk is set. This breaks the feedback loop without affecting normal SLVSTART processing, which is already guarded in the top-level IRQ handler by checking that MSTATUS is in SLVREQ state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Master Request IBI handler, when the SVC_I3C_QUIRK_FALSE_SLVSTART quirk is set, explicitly clear the SLVSTART interrupt status bit after emitting the STOP condition to prevent the false-SLVSTART IRQ storm.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Exposure is limited to systems using an NPCM845 I3C controller and the affected SVC I3C master driver path. The issue is associated with the SVC_I3C_QUIRK_FALSE_SLVSTART hardware quirk.
What condition is required to trigger the CPU lockup?
An I3C target must become stuck holding SDA low, causing the controller to report a false Master Request in-band interrupt event. Handling that event by issuing a STOP can then repeatedly trigger SLVSTART interrupts and create an IRQ storm.
What is the effect of successful triggering?
The repeated interrupt loop can produce an IRQ storm that locks up the CPU. The provided impact information indicates an availability impact, with no stated confidentiality or integrity impact.
What does the fix change?
For affected hardware, the driver explicitly clears the SLVSTART interrupt status after issuing a STOP in the Master Request IBI handler. This breaks the feedback loop while leaving normal SLVSTART handling unchanged.