The i3c mipi‑i3c‑hci driver in the Linux kernel contains a race condition in its DMA dequeue routine. When several data transfers time out near one another, the hci_dma_dequeue_xfer() function can run concurrently, stopping and restarting the DMA ring out of sync. This lack of serialization can leave the ring in an inconsistent state and may cause the driver to malfunction.

All Linux kernel releases that include the mipi‑i3c‑hci driver but have not yet applied the commit adding a mutex around hci_dma_dequeue_xfer() are affected. Kernel versions built before these changes are at risk.

The flaw is confined to the kernel and would likely require an attacker with local or elevated privileges to generate simultaneous transfer timeouts, a scenario that is usually limited to trusted users or code running on the host. The CVSS score of 7.0 indicates a medium‑high severity, the EPSS score is not available, and the vulnerability is not listed in CISA KEV. Remote exploitation is unlikely without such privileges, so the overall risk for systems that expose the mipi‑i3c‑hci interface to untrusted code is moderate.