CVE-2026-80950: Linux Kernel I3C Use-After-Free Vulnerability

CVE-2026-80950 Overview

CVE-2026-80950 is a use-after-free vulnerability in the Renesas Inter-Integrated Circuit 3 (I3C) driver within the Linux kernel. The driver implements an asynchronous data transfer model using a renesas_i3c_xfer structure that is queued, processed by an interrupt handler, and freed by the waiting thread. When a transfer times out, the waiting thread dequeues and frees the structure. A late-arriving interrupt then references the freed memory, producing a kernel-level use-after-free condition that can crash the system or corrupt kernel state.

Critical Impact
A local attacker able to trigger transfer timeouts on affected hardware can cause kernel memory corruption, leading to denial of service or potential privilege escalation.

Affected Products

Linux kernel branches shipping the Renesas I3C master driver (i3c/master/renesas-i3c)
Distributions consuming affected upstream stable kernels prior to the fix commits
Embedded and industrial Linux systems using Renesas SoCs with I3C peripherals

Discovery Timeline

2026-09-11 - CVE-2026-80950 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80950

Vulnerability Analysis

The Renesas I3C driver uses an asynchronous producer-consumer pattern for hardware transfers. A calling thread allocates a renesas_i3c_xfer structure, enqueues it, and waits on a completion primitive. The hardware interrupt service routine (ISR) dequeues that transfer, updates its state, and signals the waiting thread.

The race window opens when the completion times out. The waiting thread assumes the transfer is no longer in flight, dequeues it, and frees the memory. If the hardware then raises an interrupt for that transfer, the ISR proceeds to dereference the now-freed structure. This is a classic use-after-free [CWE-416] in kernel context, reachable from any workload that can drive the I3C bus and induce timeouts.

The fix, landed in stable branches under commits 0093f9fc102b, 5f1a76ecfe90, and ec631aff9326, validates that a pending transfer is still present before the ISR accesses it. When no valid transfer exists, the handler clears status flags and disables further interrupts to prevent recurrence.

Root Cause

The driver did not synchronize ownership of the renesas_i3c_xfer object between the timeout path in process context and the ISR path. Freeing the structure without invalidating the pointer visible to the ISR left a dangling reference exploitable across the timeout boundary.

Attack Vector

Exploitation requires local access with the ability to issue I3C operations on a system with the affected Renesas driver loaded. An attacker induces transfers that time out, then relies on the trailing hardware interrupt to trigger the use-after-free. Successful exploitation impacts kernel memory integrity and system availability.

// No verified public exploit code is available for CVE-2026-80950.
// See kernel commits 0093f9fc102b, 5f1a76ecfe90, and ec631aff9326
// for the authoritative fix and technical context.

Detection Methods for CVE-2026-80950

Indicators of Compromise

Unexpected kernel oops or panic messages referencing renesas_i3c symbols or the renesas_i3c_xfer structure
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the I3C interrupt path on kernels built with sanitizers
Repeated I3C transfer timeout messages in dmesg followed by interrupt handler faults

Detection Strategies

Inventory Linux hosts and embedded devices running Renesas SoCs and verify the kernel version against the patched stable releases
Enable kernel crash collection (kdump, pstore) to capture faults originating in the I3C driver for post-incident analysis
Correlate dmesg timeout warnings with subsequent kernel faults to identify systems exposed to the race

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized log platform for anomaly detection on driver-specific stack traces
Alert on process crashes or kernel warnings tied to I3C bus activity, especially on production embedded fleets
Track patch compliance for kernel updates across distributions consuming the affected stable branches

How to Mitigate CVE-2026-80950

Immediate Actions Required

Apply the upstream stable kernel updates containing commits 0093f9fc102b, 5f1a76ecfe90, and ec631aff9326
Rebuild and redeploy custom or vendor kernels for Renesas-based platforms with the fix backported
Restrict local access to systems where the Renesas I3C driver is loaded until patches are deployed

Patch Information

The fix validates the transfer pointer inside the interrupt handler before use, clears status flags, and disables interrupts when no valid transfer exists. Patches are available in the mainline and stable kernel trees via the following references: Kernel commit 0093f9fc102b, Kernel commit 5f1a76ecfe90, and Kernel commit ec631aff9326.

Workarounds

Unload or blacklist the Renesas I3C driver module on systems that do not require I3C functionality
Limit user accounts with access to I3C device nodes and enforce least-privilege permissions on /dev entries associated with the bus
Increase transfer timeout tolerances only as a temporary measure; this reduces but does not eliminate the race window

bash

# Blacklist the Renesas I3C driver until the kernel is patched
echo "blacklist renesas-i3c" | sudo tee /etc/modprobe.d/blacklist-renesas-i3c.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep renesas_i3c