Riskcovery

CVE-2026-43353

i3c: mipi-i3c-hci: Fix race in DMA ring dequeue

State
Published
Severity
7.8 High
Published
May 8, 2026
Updated
Oct 30, 2026
Reserved
May 1, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

i3c: mipi-i3c-hci: Fix race in DMA ring dequeue

The HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for multiple transfers that timeout around the same time. However, the function is not serialized and can race with itself.

When a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes incomplete transfers, and then restarts the ring. If another timeout triggers a parallel call into the same function, the two instances may interfere with each other - stopping or restarting the ring at unexpected times.

Add a mutex so that hci_dma_dequeue_xfer() is serialized with respect to itself.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 9ad9a52cce2828d932ae9495181e3d6414f72c07 to before d2fa9b855c7b42b34b2fb32731bf533952370384Affected
  • 9ad9a52cce2828d932ae9495181e3d6414f72c07 to before 73bb6b15f1fd71479ed12b314876f3ce5935b80aAffected
  • 9ad9a52cce2828d932ae9495181e3d6414f72c07 to before 16061383a9def977e4be908c7dcede9a8a4227fdAffected
  • 9ad9a52cce2828d932ae9495181e3d6414f72c07 to before b684b420a5bb0ea1b0e13abfdb8ce41c5266e62eAffected
  • 9ad9a52cce2828d932ae9495181e3d6414f72c07 to before 4faa1e9c67a2229f6749190aedaf88ce0391efd2Affected
  • 9ad9a52cce2828d932ae9495181e3d6414f72c07 to before 1dca8aee80eea76d2aae21265de5dd64f6ba0f09Affected
LinuxLinux
  • 5.11Affected
  • before 5.11Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.19 through 6.18.*Not affected
  • 6.19.9 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.