CVE-2026-80950
Received Received - Intake

Use-After-Free in Renesas I3C Linux Kernel Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion. The interrupt handler dequeues the transfer, updates/uses it, and signals the waiting thread. If the completion times out, the waiting thread dequeues the transfer and free it. If an interrupt fires after that, the handler may access freed memory, leading to crashes. Check that the transfer is still valid before accessing it in the interrupt handler. With it clear any status flags and disable all the interrupts to avoid triggering the same interrupts again.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-80950
EUVD
EUVD-2026-76273

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
renesas i3c *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's Renesas I3C driver. It involves an asynchronous data transfer model where a transfer structure is prepared, enqueued, and waited upon. If a timeout occurs, the waiting thread may free the transfer structure while an interrupt handler could still attempt to access it, leading to use-after-free and potential system crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's Renesas I3C driver and may cause system crashes due to accessing freed memory. Detection requires checking kernel logs for crashes or unexpected I3C driver behavior. Monitor dmesg or system logs for I3C-related errors or kernel panics.

Impact Analysis

This vulnerability could cause system crashes due to memory corruption when the kernel tries to access freed memory. Users may experience unexpected system failures, data corruption, or denial of service if the driver is actively used for I3C communication.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this vulnerability. If an update is not immediately available, consider disabling the Renesas I3C driver if not required, or restrict its usage until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80950. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart