The defect occurs in the Linux kernel's I3C master driver on NPCM845 devices. When a slave device holds the SDA line low, the controller generates a false Master Request interrupt. The driver responds by emitting a STOP condition to reset the bus. However, the SVC_I3C_QUIRK_FALSE_SLVSTART quirk causes the STOP to set the SLVSTART interrupt flag unintentionally. The driver then processes a false SLVSTART again, triggering another STOP, and the loop continues, creating a persistent interrupt storm that can lock up the CPU and halt system operation. This results in a denial‑of‑service condition.

Any Linux kernel running on hardware with the NPCM845 I3C controller is potentially affected. The issue is not tied to a specific kernel release in the data, so all current versions that have not yet applied the patch are vulnerable. It particularly impacts SoCs that expose the NPCM845 I3C master to user devices or peripherals.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The defect can still allow a malicious or misbehaving I3C slave to trigger an interrupt storm that locks the CPU, resulting in denial of service. No public exploit has been reported. The attack would require physical or logical access to the I3C bus, likely local to the system, and would be facilitated by a misbehaving device. The low exploitation probability does not reduce the impact of the potential lockup, so immediate remediation remains recommended.