CVE-2026-80954

Received Received - Intake

Race Condition in Linux Kernel I3C Subsystem

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() i3c_device_get_supported_xfer_mode() uses dev->desc to obtain the master controller. However, dev->desc must not be dereferenced unless bus->lock is held, and this function does not take that lock. The function only needs access to the master controller associated with the device's bus. Use dev->bus instead, which is always valid for the lifetime of the device and does not require dereferencing dev->desc.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80954

EUVD

EUVD-2026-76277

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a race condition vulnerability in the Linux kernel's I3C subsystem. The function i3c_device_get_supported_xfer_mode() incorrectly accesses dev->desc without holding the bus lock, which can lead to a use-after-free or other memory corruption issues if the device descriptor changes concurrently.

Detection Guidance

This vulnerability is specific to the Linux kernel's I3C subsystem and requires code analysis rather than network or system commands for detection. Check if your kernel version includes the vulnerable function i3c_device_get_supported_xfer_mode() by examining kernel source code or running uname -a to verify kernel version.

Impact Analysis

This vulnerability could allow local attackers to escalate privileges, cause denial of service, or execute arbitrary code in the kernel. Systems running vulnerable Linux kernel versions with I3C device support are at risk.

Mitigation Strategies

Update your Linux kernel to a patched version where this issue is resolved. Monitor your distribution's security advisories for kernel updates addressing CVE-2026-80954. Avoid manual code changes unless you are certain of the fix.

Hi! I’m here to help you understand CVE-2026-80954. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70