The mipi-i3c-hci driver in the Linux kernel contains a race condition in its DMA dequeue routine. When multiple data transfers time out simultaneously, hci_dma_dequeue_xfer() can run concurrently, stopping and restarting the DMA ring out of sync. This lack of serialization can leave the ring in an inconsistent state, potentially causing the driver to malfunction or restart, which corresponds to CWE-362 (Race Condition) and CWE-820 (Failure to Synchronize).

Linux kernel releases that include the mipi‑i3c‑hci driver before the commit that adds a mutex around hci_dma_dequeue_xfer() are affected. This includes all standard builds of the kernel and the 7.0 release candidates RC1, RC2, and RC3 listed in the CPE data.

The flaw is confined to the kernel and would likely require an attacker with local or elevated privileges to orchestrate simultaneous DMA timeouts. The CVSS score of 7.8 indicates medium‑high severity, while an EPSS score of < 1 % points to a very low probability of exploitation. The vulnerability is not listed in CISA KEV. Remote exploitation is unlikely without such privileges, making the overall risk moderate for systems that expose the mipi‑i3c‑hci interface to untrusted code.