GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80953 (GCVE-0-2026-80953)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-13 06:28
VLAI
Title
i3c: master: adi: initialize the lock before enabling interrupts
Summary
In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A pending CMDR interrupt can therefore run adi_i3c_master_irq() and take master->xferqueue.lock before the dynamic lock has been initialized. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the probe ordering and the IRQ path adi_i3c_master_probe() -> adi_i3c_master_irq() -> xferqueue.lock, with a pending CMDR interrupt arriving after REG_IRQ_PENDING_CMDR is unmasked. Lockdep reported: INFO: trying to register non-static key. you didn't initialize this object before use? lock_acquire+0xbb/0x290 _raw_spin_lock_irqsave+0x36/0x60 adi_i3c_master_irq+0x32/0x56 [vuln_msv] adi_i3c_master_probe+0x5a/0xf47 [vuln_msv] Initialize the transfer queue and IBI state before requesting and unmasking the IRQ.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086 , < a15a1b95de980362c14f32f519b293b0d12ce86f (git)
Affected: a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086 , < de8c32b0a246bbb4b44ec29e12769496a0bf66f7 (git)
Affected: a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086 , < 8a53f9102a0d3eeb8784999f925028acf339c276 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i3c/master/adi-i3c-master.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a15a1b95de980362c14f32f519b293b0d12ce86f",
              "status": "affected",
              "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086",
              "versionType": "git"
            },
            {
              "lessThan": "de8c32b0a246bbb4b44ec29e12769496a0bf66f7",
              "status": "affected",
              "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086",
              "versionType": "git"
            },
            {
              "lessThan": "8a53f9102a0d3eeb8784999f925028acf339c276",
              "status": "affected",
              "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i3c/master/adi-i3c-master.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: adi: initialize the lock before enabling interrupts\n\nadi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR\nbefore the controller\u0027s IBI state, transfer queue list and transfer\nqueue lock are initialized.  A pending CMDR interrupt can therefore run\nadi_i3c_master_irq() and take master-\u003exferqueue.lock before the dynamic\nlock has been initialized.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the probe ordering and the IRQ path\nadi_i3c_master_probe() -\u003e adi_i3c_master_irq() -\u003e xferqueue.lock, with a\npending CMDR interrupt arriving after REG_IRQ_PENDING_CMDR is unmasked.\nLockdep reported:\n\n  INFO: trying to register non-static key.\n  you didn\u0027t initialize this object before use?\n  lock_acquire+0xbb/0x290\n  _raw_spin_lock_irqsave+0x36/0x60\n  adi_i3c_master_irq+0x32/0x56 [vuln_msv]\n  adi_i3c_master_probe+0x5a/0xf47 [vuln_msv]\n\nInitialize the transfer queue and IBI state before requesting and\nunmasking the IRQ."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached from adi_i3c_master_probe() on the Analog Devices AXI/FPGA I3C platform driver, which unmasks REG_IRQ_PENDING_CMDR so adi_i3c_master_irq() runs during local boot, module load, or driver rebind; there is no network, Bluetooth, or USB packet path into this controller.\nAC:L - Unmasking CMDR with leftover pending controller state causes adi_i3c_master_irq() to run immediately and take xferqueue.lock before spin_lock_init(); stale post-reset or warm-reboot interrupt bits make this deterministic without an attacker-uncontrollable race or heap layout.\nPR:N - adi_i3c_master_probe() performs no capability or authentication checks before request_irq() and unmasking CMDR; on FPGA/SoC boards with this IP the vulnerable probe runs automatically at kernel boot without the attacker holding Linux privileges.\nUI:N - No victim action is required; a pending CMDR interrupt during driver probe at boot or reboot invokes the uninitialized-lock IRQ path without anyone opening I3C/I2C device nodes or configuring transfers.\nS:U - Impact is kernel lock and memory corruption inside the host kernel that owns the I3C master; this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - adi_i3c_master_irq() takes the uninitialized xferqueue.lock in hard-IRQ context and may also process leftover IBI/DAA pending bits while ibi.slots is still NULL, which is undefined lock/pointer behavior that can be leveraged for kernel memory disclosure.\nI:H - Concurrent spin_lock_init() versus IRQ-context use of the same dynamic lock, plus IBI handling through a NULL slots table, can corrupt lock metadata and adjacent driver/heap state, enabling a write or control-flow primitive under conservative kernel CNA scoring.\nA:H - The commit\u0027s lockdep PoC already shows lock_acquire on a non-static key from adi_i3c_master_irq() during probe; DEBUG_SPINLOCK BUG, oops/panic, or a hung IRQ path on affected FPGA/embedded boards is full availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:28:26.721Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a15a1b95de980362c14f32f519b293b0d12ce86f"
        },
        {
          "url": "https://git.kernel.org/stable/c/de8c32b0a246bbb4b44ec29e12769496a0bf66f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a53f9102a0d3eeb8784999f925028acf339c276"
        }
      ],
      "title": "i3c: master: adi: initialize the lock before enabling interrupts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80953",
    "datePublished": "2026-09-11T19:42:22.515Z",
    "dateReserved": "2026-08-26T14:34:25.804Z",
    "dateUpdated": "2026-09-13T06:28:26.721Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80953",
      "date": "2026-09-18",
      "epss": "0.0018",
      "percentile": "0.07912"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/i3c/master/adi-i3c-master.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a15a1b95de980362c14f32f519b293b0d12ce86f",
                    "status": "affected",
                    "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "de8c32b0a246bbb4b44ec29e12769496a0bf66f7",
                    "status": "affected",
                    "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8a53f9102a0d3eeb8784999f925028acf339c276",
                    "status": "affected",
                    "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/i3c/master/adi-i3c-master.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.18"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: adi: initialize the lock before enabling interrupts\n\nadi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR\nbefore the controller\u0027s IBI state, transfer queue list and transfer\nqueue lock are initialized.  A pending CMDR interrupt can therefore run\nadi_i3c_master_irq() and take master-\u003exferqueue.lock before the dynamic\nlock has been initialized.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the probe ordering and the IRQ path\nadi_i3c_master_probe() -\u003e adi_i3c_master_irq() -\u003e xferqueue.lock, with a\npending CMDR interrupt arriving after REG_IRQ_PENDING_CMDR is unmasked.\nLockdep reported:\n\n  INFO: trying to register non-static key.\n  you didn\u0027t initialize this object before use?\n  lock_acquire+0xbb/0x290\n  _raw_spin_lock_irqsave+0x36/0x60\n  adi_i3c_master_irq+0x32/0x56 [vuln_msv]\n  adi_i3c_master_probe+0x5a/0xf47 [vuln_msv]\n\nInitialize the transfer queue and IBI state before requesting and\nunmasking the IRQ."
          }
        ],
        "id": "CVE-2026-80953",
        "lastModified": "2026-09-13T07:17:02.463",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:01.040",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8a53f9102a0d3eeb8784999f925028acf339c276"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a15a1b95de980362c14f32f519b293b0d12ce86f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/de8c32b0a246bbb4b44ec29e12769496a0bf66f7"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T17:36:06+00:00",
      "cve": "CVE-2026-80953",
      "id": "CVE-2026-80953",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: i3c: master: adi: initialize the lock before enabling interrupts",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80953.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:05:36Z",
      "cve": "CVE-2026-80953",
      "id": "CVE-2026-80953",
      "initial_release_date": "2026-09-12T16:37:01Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80953",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80953.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.