CVE-2026-80954

The Linux kernel's i3c subsystem contains a race condition in i3c_device_get_supported_xfer_mode(), which dereferences dev->desc without holding the required bus->lock. Because dev->desc can be freed or altered concurrently (for example during device hot-removal or re-enumeration on the I3C bus), a local attacker with low privileges who can trigger this code path while the descriptor changes could cause a use-after-free or invalid dereference, resulting in kernel memory corruption with high impact to confidentiality, integrity, and availability (CVSS 7.8). The upstream fix removes the unlocked dereference by using dev->bus, which is valid for the device's lifetime. Only systems whose kernels include the I3C subsystem and whose drivers actually call this API (primarily embedded devices using the MIPI I3C bus) are exposed to the vulnerable path. No public proof of concept is known and the flaw is not listed in CISA's KEV catalog.

What to do: Update to a kernel release containing the fix, which replaces the unlocked dev->desc dereference with a read of dev->bus. If immediate patching is not possible, determine actual exposure by checking whether your kernel enables the I3C subsystem (CONFIG_I3C) and whether any loaded drivers call i3c_device_get_supported_xfer_mode() — systems without I3C hardware or such drivers are not practically reachable. Additionally, restrict local untrusted shell/device access and monitor kernel logs for oopses or crashes originating in i3c code paths.