CVE-2026-80950

i3c: renesas: Check that the transfer is valid before accessing it

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

i3c: renesas: Check that the transfer is valid before accessing it

The Renesas I3C driver uses an asynchronous model to transfer data. It
prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion.
The interrupt handler dequeues the transfer, updates/uses it, and signals
the waiting thread.

If the completion times out, the waiting thread dequeues the transfer and
free it. If an interrupt fires after that, the handler may access freed
memory, leading to crashes.

Check that the transfer is still valid before accessing it in the
interrupt handler. With it clear any status flags and disable all
the interrupts to avoid triggering the same interrupts again.

Analysis

Technical impact

The Renesas I3C driver performs asynchronous data transfers without verifying that a transfer structure remains valid when the interrupt handler processes it after a timeout. This memory, resulting in a use‑after‑free condition that can crash the kernel. The flaw is categorized as a memory corruption weakness (CWE‑825) and its primary consequence is an availability impact due to a kernel panic.

Affected Systems

The issue is present in the Linux kernel’s Renesas I3C driver for Renesas I3 i3c renesas module and has not applied the patch is potentially affected. No particular kernel version range is specified in the advisory, so all kernels that include the driver remain at risk until the fix is applied.

Risk and Exploitability

The vulnerability has a CVSS score of 7.8, indicating high severity, and an EPSS score of less than 1%, suggesting a low probability of exploitation. It is not listed in the CISA KEV catalog. Exploitation would require a timed‑ freed structure, which is non‑trivial but possible. Successful exploitation would cause a kernel crash, resulting in a denial‑of‑service impact.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d028219a9f1485914492bf373406f6a0e665ace2`	affected	< 0093f9fc102ba8b98561fdd2f8559553ef56be59
`d028219a9f1485914492bf373406f6a0e665ace2`	affected	< ec631aff93261c6d031f953549802322032f2aba
`d028219a9f1485914492bf373406f6a0e665ace2`	affected	< 5f1a76ecfe90544a28d657306c9b3caa66ba0e63

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[d028219a9f1485914492bf373406f6a0e665ace2,0093f9fc102ba8b98561fdd2f8559553ef56be59)`	affected	code_commit	—
`[d028219a9f1485914492bf373406f6a0e665ace2,ec631aff93261c6d031f953549802322032f2aba)`	affected	code_commit	—
`[d028219a9f1485914492bf373406f6a0e665ace2,5f1a76ecfe90544a28d657306c9b3caa66ba0e63)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.17`	affected	generic	—
`[0,6.17)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel patch that adds validity checks before accessing the transfer structure in the interrupt handler.
If a kernel upgrade is not immediately feasible, disable the Renesas I3C driver by unloading the module or setting CONFIG_I3C=n in the kernel configuration.
Reboot the system after disabling or updating to ensure that no queued transfers remain pending.

Generated by OpenCVE AI on September 21, 2026 at 02:51 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.173% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0093f9fc102ba8b98561fdd2f8559553ef56be59
https://git.kernel.org/stable/c/5f1a76ecfe90544a28d657306c9b3caa66ba0e63
https://git.kernel.org/stable/c/ec631aff93261c6d031f953549802322032f2aba
https://nvd.nist.gov/vuln/detail/CVE-2026-80950
https://www.cve.org/CVERecord?id=CVE-2026-80950

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80950 https://www.cve.org/CVERecord?id=CVE-2026-80950
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion. The interrupt handler dequeues the transfer, updates/uses it, and signals the waiting thread. If the completion times out, the waiting thread dequeues the transfer and free it. If an interrupt fires after that, the handler may access freed memory, leading to crashes. Check that the transfer is still valid before accessing it in the interrupt handler. With it clear any status flags and disable all the interrupts to avoid triggering the same interrupts again.
Title		i3c: renesas: Check that the transfer is valid before accessing it
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0093f9fc102ba8b98561fdd2f8559553ef56be59 https://git.kernel.org/stable/c/5f1a76ecfe90544a28d657306c9b3caa66ba0e63 https://git.kernel.org/stable/c/ec631aff93261c6d031f953549802322032f2aba