The Linux kernel driver for the I3C MIPI interface contains logic flaws that incorrectly attempt to abort a DMA ring. The driver unconditionally aborts even when the ring is already stopped, never re‑initialises the completion used to wait for abort, and inadvertently clears the control enable bit, resetting ring pointers and disrupting controller state. If the ring is already stopped the abort is treated as a success. These flaws can lead to corrupted ring state and loss of communication with I3C devices, resulting in a denial of service or system instability for processes that rely on the driver.

All Linux kernel releases that include the i3c mipi-i3c-hci driver before the patch was applied are affected. The flaw exists in the kernel’s i3c subsystem prior to the commit that fixes the abort logic; no specific version numbers are listed, but any distribution using a kernel older than the patch is impacted.

The CVSS score of 7.0 indicates a medium‑to‑high severity vulnerability, and the EPSS score is not available while the vulnerability is not listed in the CISA KEV catalog. The flaw requires execution of the driver’s abort routine, implying that an attacker would need kernel‑level privileges or an ability to trigger the abort sequence from user space through a device interface. If successfully triggered, the impacted system could lose I3C functionality or experience a kernel panic, leading to service disruption. Because the state corruption is confined to the specific I3C controller instance, the impact is limited to devices that use that controller.