CVE-2026-80950

The Linux kernel's Renesas I3C driver contains a use-after-free in its interrupt handling path: when a data transfer times out, the waiting thread dequeues and frees the 'struct renesas_i3c_xfer', but a late interrupt can still fire and access that already-freed memory, causing kernel crashes. The flaw is triggered by racing a transfer timeout against interrupt delivery on systems using Renesas I3C hardware, and a local attacker with low privileges could exploit the resulting kernel memory corruption for a crash at minimum, with CVSS 3.1 rating the worst case as high impact to confidentiality, integrity, and availability (7.8). Affected systems are limited to those running kernels with the Renesas I3C driver in use, typically embedded and automotive platforms built on Renesas SoCs (such as R-Car-based designs). The fix validates that the transfer is still valid in the interrupt handler and clears status flags while disabling interrupts to prevent re-triggering. Exploitation status: not in the CISA KEV catalog and no public proof-of-concept is known.

What to do: Apply a kernel update that includes the upstream fix (which validates the transfer in the interrupt handler and disables interrupts on timeout) as soon as your distro or vendor ships it. Verify whether your systems actually use the Renesas I3C driver (check loaded modules and device tree on Renesas/R-Car hardware); systems without this hardware are not exposed. Because the attack requires local access, restrict unprivileged local accounts and container workloads on affected embedded devices until patched.