CVE-2026-89728

Received Received - Intake

Out-of-Bounds Access in Renesas I3C Controller

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA (Dynamic Address Assignment), the controller reports the result via the NRSPQP (Normal Response Queue Port Register). The data length field of the response descriptor, which is accessible through the NRSPQP register, indicates the number of devices remaining after DAA. Consequently, when the bus is empty, this field contains the maximum number of devices supported by the controller (8 for the Renesas I3C controller). Adjust the condition that computes the newly discovered devices bitmask to prevent an out-of-bounds when the I3C bus is empty.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89728

EUVD

EUVD-2026-76640

Affected Vendors & Products

Vendor	Product	Version / Range
renesas	i3c	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's I3C (Improved Inter-Integrated Circuit) driver for Renesas controllers. It involves an out-of-bounds access issue during Dynamic Address Assignment (DAA). When the I3C bus is empty, the controller incorrectly reports the maximum number of supported devices (8) in a response descriptor. This can lead to software accessing memory outside intended bounds when processing the result.

Detection Guidance

This vulnerability is specific to the Linux kernel's I3C Renesas driver and requires kernel-level inspection. Detection involves checking kernel logs for I3C-related errors or examining the driver code for out-of-bounds access during DAA. No standard network commands apply.

Impact Analysis

This vulnerability may cause system instability or crashes if exploited. It could allow unauthorized memory access, potentially leading to privilege escalation or denial-of-service conditions on affected Linux systems using Renesas I3C controllers.

Mitigation Strategies

Apply the Linux kernel patch that fixes the out-of-bounds access in the Renesas I3C driver. Update to a kernel version containing the fix or backport the patch manually. Monitor I3C bus operations for errors after applying the fix.

Hi! I’m here to help you understand CVE-2026-89728. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70