GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80954 (GCVE-0-2026-80954)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-13 06:28
VLAI
Title
i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode()
Summary
In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() i3c_device_get_supported_xfer_mode() uses dev->desc to obtain the master controller. However, dev->desc must not be dereferenced unless bus->lock is held, and this function does not take that lock. The function only needs access to the master controller associated with the device's bus. Use dev->bus instead, which is always valid for the lifetime of the device and does not require dereferencing dev->desc.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 256a21743d911f94ce92fe28f793cd586f3860b2 , < 251db58324ea4792c3f9f692ab09be148e051969 (git)
Affected: 256a21743d911f94ce92fe28f793cd586f3860b2 , < 8bed7f4fa710914b7f05fd59998316bfb4d43385 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i3c/device.c",
            "drivers/i3c/internals.h",
            "drivers/i3c/master.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "251db58324ea4792c3f9f692ab09be148e051969",
              "status": "affected",
              "version": "256a21743d911f94ce92fe28f793cd586f3860b2",
              "versionType": "git"
            },
            {
              "lessThan": "8bed7f4fa710914b7f05fd59998316bfb4d43385",
              "status": "affected",
              "version": "256a21743d911f94ce92fe28f793cd586f3860b2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i3c/device.c",
            "drivers/i3c/internals.h",
            "drivers/i3c/master.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: Fix unlocked dereference of dev-\u003edesc in i3c_device_get_supported_xfer_mode()\n\ni3c_device_get_supported_xfer_mode() uses dev-\u003edesc to obtain the\nmaster controller.  However, dev-\u003edesc must not be dereferenced unless\nbus-\u003elock is held, and this function does not take that lock.\n\nThe function only needs access to the master controller associated with\nthe device\u0027s bus.  Use dev-\u003ebus instead, which is always valid for the\nlifetime of the device and does not require dereferencing dev-\u003edesc."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The unlocked desc dereference is reached from local IIO sysfs reads of an I3C-backed MMC5633 magnetometer (in_magn_*_raw/in_temp_raw via iio_read_channel_info) and from /dev/iio:deviceN; I3C is an on-board host bus with no network or Bluetooth packet path.\nAC:L - A local attacker can loop those IIO reads while concurrently forcing Dynamic Address Assignment, which replaces and kfree()s i3c_dev_desc (hot-join, MIPI I3C HCI/Renesas resume re-DAA, or sysfs do_daa). The attacker drives the unlocked-read side and can retry until it races with DAA.\nPR:L - IIO channel attributes are created 0444/0644 and iio_read_channel_info performs no capability check, so an unprivileged local user on Android, automotive, or embedded I3C boards can invoke mmc5633_read_raw without init-namespace root.\nUI:N - The attacker performs their own sysfs or IIO chardev reads against an already-present I3C device; no separate victim action such as plugging hardware or mounting a filesystem is required.\nS:U - The use-after-free corrupts an i3c_dev_desc in the host kernel heap and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Unlocked load of dev-\u003edesc races with DAA\u0027s i3c_master_free_i3c_dev(), so i3c_dev_get_master() walks a freed descriptor (common.master then this-\u003einfo.hdr_cap). Reclaiming that object yields a kernel read primitive; UAF is High confidentiality.\nI:H - A sprayed fake i3c_dev_desc lets the nested pointer walk interpret attacker-controlled heap as kernel objects, enabling further writes and control-flow hijack through the same freed slab; UAF is High integrity.\nA:H - Dereferencing a NULL or freed desc in i3c_dev_get_master() causes a kernel oops or panic even without a full exploit, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:28:27.960Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/251db58324ea4792c3f9f692ab09be148e051969"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bed7f4fa710914b7f05fd59998316bfb4d43385"
        }
      ],
      "title": "i3c: Fix unlocked dereference of dev-\u003edesc in i3c_device_get_supported_xfer_mode()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80954",
    "datePublished": "2026-09-11T19:42:23.169Z",
    "dateReserved": "2026-08-26T14:34:25.804Z",
    "dateUpdated": "2026-09-13T06:28:27.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80954",
      "date": "2026-09-17",
      "epss": "0.00154",
      "percentile": "0.04907"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/i3c/device.c",
                  "drivers/i3c/internals.h",
                  "drivers/i3c/master.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "251db58324ea4792c3f9f692ab09be148e051969",
                    "status": "affected",
                    "version": "256a21743d911f94ce92fe28f793cd586f3860b2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8bed7f4fa710914b7f05fd59998316bfb4d43385",
                    "status": "affected",
                    "version": "256a21743d911f94ce92fe28f793cd586f3860b2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/i3c/device.c",
                  "drivers/i3c/internals.h",
                  "drivers/i3c/master.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.19"
                  },
                  {
                    "lessThan": "6.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: Fix unlocked dereference of dev-\u003edesc in i3c_device_get_supported_xfer_mode()\n\ni3c_device_get_supported_xfer_mode() uses dev-\u003edesc to obtain the\nmaster controller.  However, dev-\u003edesc must not be dereferenced unless\nbus-\u003elock is held, and this function does not take that lock.\n\nThe function only needs access to the master controller associated with\nthe device\u0027s bus.  Use dev-\u003ebus instead, which is always valid for the\nlifetime of the device and does not require dereferencing dev-\u003edesc."
          }
        ],
        "id": "CVE-2026-80954",
        "lastModified": "2026-09-13T07:17:02.590",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:01.167",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/251db58324ea4792c3f9f692ab09be148e051969"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8bed7f4fa710914b7f05fd59998316bfb4d43385"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T17:36:10+00:00",
      "cve": "CVE-2026-80954",
      "id": "CVE-2026-80954",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: i3c: Fix unlocked dereference of dev-\u003edesc in i3c_device_get_supported_xfer_mode()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80954.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:05:34Z",
      "cve": "CVE-2026-80954",
      "id": "CVE-2026-80954",
      "initial_release_date": "2026-09-12T16:37:00Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80954",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80954.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.