CVE-2026-80951: Linux Kernel I3C Master Buffer Overflow

CVE-2026-80951 Overview

CVE-2026-80951 is an out-of-bounds write vulnerability in the Linux kernel's Silvaco I3C (SVC) master driver. The flaw resides in svc_i3c_master_handle_ibi(), which reads In-Band Interrupt (IBI) payloads from the RX FIFO into an IBI slot. The read loop is bounded by the hardware FIFO size (SVC_I3C_FIFO_SIZE) rather than the caller-requested max_payload_len, allowing a malicious or malfunctioning I3C device to write past the slot buffer into the IBI pool.

Critical Impact
A device on the I3C bus can send more IBI bytes than the driver's slot holds, causing kernel heap corruption in the IBI pool and potential privilege escalation or denial of service.

Affected Products

Linux kernel builds that include the i3c/master/svc (Silvaco I3C master) driver
Systems using the mctp-i3c driver, which requests a max_payload_len of 1 byte
Stable branches referenced by kernel commits 35aa673, 5697d77, 7c099b0, 7cc5ba7, aac3c5a, e2bda39, and f296a0d

Discovery Timeline

2026-09-11 - CVE-2026-80951 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80951

Vulnerability Analysis

The Silvaco I3C master driver handles IBI events by draining the controller's RX FIFO into a per-device IBI slot. The IBI pool is allocated by i3c_generic_ibi_alloc_pool(), which sizes each slot's slot->data buffer to the driver-requested max_payload_len. Drivers such as mctp-i3c request a payload length as small as 1 byte.

The request path, svc_i3c_master_request_ibi(), only rejects max_payload_len values larger than SVC_I3C_FIFO_SIZE. It does not enforce that the drain loop respects the smaller, driver-chosen slot size. When an IBI arrives, readsb() copies up to the controller's RXCOUNT (up to 31 bytes) into slot->data without checking the remaining slot capacity.

Any I3C peripheral that transmits more bytes than the slot can hold triggers a heap out-of-bounds write into the IBI pool. The corruption occurs in kernel context and is reachable from bus-connected hardware without user authentication.

Root Cause

The root cause is a missing bounds check between two independently sized buffers. slot->data is sized to dev->ibi->max_payload_len, but the copy loop uses SVC_I3C_FIFO_SIZE as its upper bound. When max_payload_len < SVC_I3C_FIFO_SIZE, any additional bytes the device sends overflow the slot allocation inside the IBI pool.

Attack Vector

Exploitation requires an attacker-controlled or malfunctioning device on the I3C bus. The device sends an IBI whose payload exceeds the driver's requested max_payload_len. The kernel driver then writes the excess bytes past slot->data, corrupting adjacent memory in the IBI pool. Attack surface is limited to systems with I3C hardware and peripherals reachable by an attacker, which is common in embedded, telemetry, and management-controller scenarios.

No public exploit or proof-of-concept has been published. The vulnerability is described in the upstream kernel fix, which bounds the loop by dev->ibi->max_payload_len, clamps each readsb() to the space remaining in the slot, and flushes any leftover bytes from the RX FIFO so they do not leak into subsequent transfers.

Detection Methods for CVE-2026-80951

Indicators of Compromise

Unexpected kernel warnings, KASAN slab-out-of-bounds reports, or oopses referencing svc_i3c_master_handle_ibi or the IBI pool allocator
Kernel crashes or memory corruption on systems using the i3c-master-svc or mctp-i3c drivers
Anomalous I3C bus traffic where devices emit IBI payloads larger than the negotiated max_payload_len

Detection Strategies

Enable CONFIG_KASAN on test kernels to catch out-of-bounds writes in the IBI pool during IBI handling
Monitor dmesg and centralized log pipelines for stack traces containing svc_i3c_master_handle_ibi, i3c_generic_ibi_alloc_pool, or slab corruption messages
Inventory hosts running kernels that include the SVC I3C master driver and correlate against installed patch levels

Monitoring Recommendations

Forward kernel logs from I3C-enabled hosts to a centralized log platform and alert on new panics or BUG: messages from i3c subsystems
Track kernel package versions across the fleet and flag hosts still running pre-patch versions of the affected stable branches
Where feasible, monitor I3C bus telemetry for devices producing oversized IBI transactions

How to Mitigate CVE-2026-80951

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 35aa6730, 5697d779, 7c099b0b, 7cc5ba75, aac3c5aa, e2bda39d, and f296a0d5 from the affected stable branches
Rebuild and redeploy custom kernels that include the drivers/i3c/master/svc-i3c-master.c driver
Audit I3C peripherals attached to production systems and remove or isolate untrusted devices

Patch Information

The fix bounds the IBI read loop by dev->ibi->max_payload_len, clamps each readsb() call to the remaining slot capacity, and flushes leftover bytes from the RX FIFO. The change mirrors the approach used in the DesignWare I3C (dw-i3c) driver. Patch commits are published at Kernel Git Commit 35aa673, Kernel Git Commit 5697d77, Kernel Git Commit 7c099b0, Kernel Git Commit 7cc5ba7, Kernel Git Commit aac3c5a, Kernel Git Commit e2bda39, and Kernel Git Commit f296a0d.

Workarounds

Unload or blacklist the svc-i3c-master and mctp-i3c kernel modules on hosts that do not require them
Physically or logically isolate untrusted I3C peripherals until the patched kernel is deployed
Restrict administrative access to the I3C bus and its device tree bindings on affected platforms

bash

# Blacklist the vulnerable driver on systems that do not need it
echo "blacklist svc-i3c-master" | sudo tee /etc/modprobe.d/blacklist-svc-i3c.conf
echo "blacklist mctp-i3c" | sudo tee -a /etc/modprobe.d/blacklist-svc-i3c.conf
sudo update-initramfs -u