CVE-2026-45863: Linux Kernel Memory Leak Vulnerability

CVE-2026-45863 Overview

CVE-2026-45863 is a memory leak vulnerability in the Linux kernel's Designware (DW) I3C master driver. The flaw resides in the dw_i3c_master_i2c_xfers() function within the i3c/dw subsystem. The function allocates memory for the transfer structure through dw_i3c_master_alloc_xfer() but fails to release that memory when pm_runtime_resume_and_get() returns an error. Each failed transfer attempt leaks the allocated xfer structure, gradually exhausting kernel memory on affected systems. The issue was identified through a prototype static analysis tool combined with manual code review and has been resolved upstream.

Critical Impact
Repeated failures in the runtime power management resume path leak kernel memory, which can degrade system stability over time on hosts using Designware I3C controllers.

Affected Products

Linux kernel versions containing the Designware I3C master driver (drivers/i3c/master/dw-i3c-master.c)
Distributions shipping mainline kernels prior to the fix commits
Embedded and server platforms using Synopsys Designware I3C controllers

Discovery Timeline

2026-05-27 - CVE-2026-45863 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45863

Vulnerability Analysis

The vulnerability is a kernel memory leak in the I3C Designware master driver. The function dw_i3c_master_i2c_xfers() handles I2C transfer requests on I3C controllers. Early in the function, it calls dw_i3c_master_alloc_xfer() to allocate a transfer descriptor. The function then invokes pm_runtime_resume_and_get() to ensure the device is powered before submitting the transfer.

When pm_runtime_resume_and_get() fails, the original code returned the error directly without freeing the previously allocated xfer structure. Each failed call permanently leaks a kernel allocation. Over many failures, the cumulative leak can pressure kernel memory and contribute to instability on long-running systems.

The fix adds a dw_i3c_master_free_xfer() call on the error path so the allocation is released before the function returns. The change is contained to the driver's error handling sequence and does not alter the success path.

Root Cause

The root cause is improper error-path resource cleanup in dw_i3c_master_i2c_xfers(). The function obtains a heap allocation prior to a fallible runtime PM call but lacks a corresponding free on the failure branch, producing a memory leak each time the PM resume fails.

Attack Vector

No CVSS vector or weakness classification has been published for this entry. Triggering the leak requires conditions that cause pm_runtime_resume_and_get() to fail during I2C transfers on a Designware I3C controller. The defect is a reliability issue rather than a remotely exploitable code path, and no proof-of-concept or in-the-wild exploitation has been reported.

The vulnerability is described in prose because no verified exploitation code is available. Refer to the upstream commits for the exact diff and impacted lines.

Detection Methods for CVE-2026-45863

Indicators of Compromise

Steady growth of unreclaimable kernel slab usage on systems using the dw-i3c-master driver
Repeated kernel log entries showing failures from pm_runtime_resume_and_get() against the I3C controller
I2C transfer errors returned to userspace clients communicating with devices behind a Designware I3C master

Detection Strategies

Inventory hosts loading the dw-i3c-master kernel module and compare their kernel versions against the patched commits 140a45b, 2537089, 8e71414, and a2c4146.
Track Slab and SUnreclaim values from /proc/meminfo over time on affected hosts to surface gradual leaks.
Correlate runtime PM failure messages in dmesg with rising kernel memory consumption.

Monitoring Recommendations

Enable kmemleak on test or staging kernels that load the Designware I3C driver to surface unreferenced allocations.
Forward kernel logs and memory metrics to a centralized log platform and alert on sustained growth in non-reclaimable slab memory.
Review I2C and I3C subsystem error counters during routine platform health checks.

How to Mitigate CVE-2026-45863

Immediate Actions Required

Identify systems running kernels that include the unpatched dw_i3c_master_i2c_xfers() implementation.
Schedule kernel updates to a stable release containing the upstream fix commits.
Where patching is delayed, plan reboots to reclaim leaked memory and reduce uptime-dependent risk.

Patch Information

The fix adds a dw_i3c_master_free_xfer() call to the error path of dw_i3c_master_i2c_xfers() when pm_runtime_resume_and_get() fails. The change has been merged into mainline and backported to stable trees. Apply a kernel build that includes the following commits: Kernel Git Commit - 140a45b, Kernel Git Commit - 2537089, Kernel Git Commit - 8e71414, and Kernel Git Commit - a2c4146.

Workarounds

Unload the dw-i3c-master module on systems that do not require I3C functionality until a patched kernel is deployed.
Address upstream causes of runtime PM resume failures, such as clock or regulator misconfiguration, to reduce the frequency of leak-triggering events.
Reboot affected hosts on a defined cadence to reset leaked kernel memory until the fix is applied.

bash

# Verify the loaded kernel version and whether the dw-i3c-master driver is in use
uname -r
lsmod | grep dw_i3c_master
dmesg | grep -iE 'i3c|pm_runtime_resume_and_get'

# Track non-reclaimable slab usage over time
grep -E 'Slab|SUnreclaim' /proc/meminfo