CVE-2026-43353
Race Condition in Linux Kernel I3C HCI DMA Dequeue
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's i3c subsystem, specifically in the mipi-i3c-hci driver. The issue is a race condition in the DMA ring dequeue function (hci_dma_dequeue_xfer()). This function can be called concurrently for multiple transfers that timeout around the same time, but it is not designed to handle simultaneous calls safely.
When a timeout occurs, the function stops the DMA ring, processes incomplete transfers, and then restarts the ring. If two calls happen in parallel due to timeouts, they can interfere with each other by stopping or restarting the ring unexpectedly, causing race conditions.
The fix involves adding a mutex to serialize calls to hci_dma_dequeue_xfer(), preventing concurrent execution and eliminating the race.
How can this vulnerability impact me? :
This race condition in the DMA ring dequeue process can lead to unpredictable behavior in the handling of DMA transfers within the i3c subsystem of the Linux kernel. Potential impacts include system instability, data corruption, or loss of data during DMA operations.
Because the function may stop or restart the DMA ring at unexpected times, it could cause incomplete or failed data transfers, which might affect device communication relying on the i3c interface.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by adding a mutex to serialize the hci_dma_dequeue_xfer() function in the Linux kernel. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.