CVE-2026-80953: Linux Kernel i3c Master Race Condition

CVE-2026-80953 Overview

CVE-2026-80953 affects the Linux kernel i3c master driver for Analog Devices (ADI) controllers. The adi_i3c_master_probe() function requests an interrupt and unmasks REG_IRQ_PENDING_CMDR before initializing the controller's In-Band Interrupt (IBI) state, transfer queue list, and transfer queue spinlock. A pending Command Response (CMDR) interrupt can then invoke adi_i3c_master_irq() and attempt to acquire master->xferqueue.lock before that lock has been initialized. The race condition can corrupt kernel synchronization state on affected local systems.

Critical Impact
Local attackers or faulty hardware timing can trigger an uninitialized spinlock acquisition in the i3c ADI master driver, leading to kernel state corruption with high confidentiality, integrity, and availability impact.

Affected Products

Linux kernel builds including the i3c master ADI driver
Systems using Analog Devices i3c controllers with the vulnerable probe ordering
Stable kernel branches prior to the commits referenced in the fix

Discovery Timeline

2026-09-11 - CVE-2026-80953 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80953

Vulnerability Analysis

The defect is a race condition [CWE-362] combined with use of an uninitialized synchronization primitive in the adi_i3c_master_probe() initialization path. The probe function registers the IRQ handler and unmasks REG_IRQ_PENDING_CMDR before calling the initialization routines that set up master->xferqueue.lock, the transfer queue list, and IBI state. If a CMDR interrupt is already pending or arrives during the window between IRQ unmask and lock initialization, the kernel dispatches adi_i3c_master_irq(), which calls _raw_spin_lock_irqsave() on a spinlock that lockdep sees as a non-static, unregistered key.

Lockdep reports the condition explicitly: INFO: trying to register non-static key. you didn't initialize this object before use? The stack trace shows the acquisition originating from adi_i3c_master_irq+0x32 invoked during adi_i3c_master_probe+0x5a. Because the interrupt path also walks the transfer queue list, uninitialized list heads may be dereferenced, producing memory corruption and unpredictable kernel behavior.

Root Cause

The probe function violates the standard Linux driver initialization ordering rule: all data structures accessed by an IRQ handler must be fully initialized before the IRQ line is enabled or unmasked. Requesting the interrupt and clearing the CMDR mask ahead of spin_lock_init() and the queue setup opens a window in which the handler executes against uninitialized memory.

Attack Vector

Exploitation requires local access with the ability to trigger driver probing or timing conditions that generate a pending CMDR interrupt. An attacker who influences hardware events on an i3c bus, or who loads/reloads the driver on a system with an active controller, can force the race. The result is kernel-level memory corruption within the driver's queue structures and synchronization state, which can degrade system integrity and availability. No user interaction is required, and no privileges are needed beyond triggering the driver load path in environments where that is permitted.

See the upstream commits for exact patch content: 8a53f9102a0d, a15a1b95de98, and de8c32b0a246.

Detection Methods for CVE-2026-80953

Indicators of Compromise

Lockdep warning INFO: trying to register non-static key referencing adi_i3c_master_irq in kernel logs
Kernel stack traces containing adi_i3c_master_irq+0x32 invoked from adi_i3c_master_probe
Unexpected soft lockups, list corruption warnings, or BUG: messages tied to i3c device initialization

Detection Strategies

Enable CONFIG_PROVE_LOCKING and CONFIG_DEBUG_SPINLOCK on test kernels to surface uninitialized lock usage during driver probe
Audit dmesg and centralized log pipelines for i3c driver warnings during boot and module reload
Compare running kernel commit hashes against the fixed upstream commits referenced in the advisory

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log store and alert on lockdep and list debug messages
Track kernel package versions across the fleet to identify hosts still running vulnerable builds
Monitor for unexpected module load and unload events involving i3c-master-adi

How to Mitigate CVE-2026-80953

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fixes referenced by commits 8a53f9102a0d, a15a1b95de98, and de8c32b0a246
Restrict kernel module loading to root and disable automatic loading of the i3c-master-adi driver on systems that do not require it
Inventory hosts that use Analog Devices i3c controllers and prioritize their patching

Patch Information

The fix reorders adi_i3c_master_probe() so that the transfer queue list, IBI state, and xferqueue.lock are initialized before the IRQ is requested and REG_IRQ_PENDING_CMDR is unmasked. Apply the vendor kernel update or rebuild from the stable branches containing the referenced commits.

Workarounds

Blacklist the i3c-master-adi module on systems that do not require i3c support until the patched kernel is deployed
Where feasible, disable the i3c controller in firmware or device tree to prevent driver binding
Delay enabling debug or hot-plug workflows that repeatedly probe the driver on unpatched hosts

bash

# Prevent the vulnerable driver from loading until the kernel is patched
echo 'blacklist i3c-master-adi' | sudo tee /etc/modprobe.d/blacklist-i3c-adi.conf
sudo depmod -a
sudo update-initramfs -u