CVE-2026-80954: Linux Kernel I3C Use-After-Free Vulnerability

CVE-2026-80954 Overview

CVE-2026-80954 is a Linux kernel vulnerability in the Improved Inter-Integrated Circuit (i3c) subsystem. The function i3c_device_get_supported_xfer_mode() dereferences dev->desc without holding the required bus->lock. This unlocked dereference creates a race condition against concurrent modifications of the device descriptor. A local attacker with low privileges can trigger the race to cause memory corruption or crash kernel execution. The upstream fix replaces the unsafe access with dev->bus, which remains valid for the lifetime of the device and requires no lock.

Critical Impact
A local low-privileged user can exploit the race condition to compromise kernel confidentiality, integrity, and availability on affected Linux systems.

Affected Products

Linux kernel versions containing the i3c subsystem prior to the fix commits
Distributions shipping vulnerable stable kernel branches
Systems with i3c bus hardware and drivers enabled

Discovery Timeline

2026-09-11 - CVE-2026-80954 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80954

Vulnerability Analysis

The vulnerability resides in the Linux kernel i3c subsystem, specifically in i3c_device_get_supported_xfer_mode(). The function accesses dev->desc to obtain a reference to the master controller managing the bus. The kernel's locking contract requires that dev->desc only be dereferenced while bus->lock is held. This function violates that contract by reading dev->desc without acquiring the lock.

When another kernel context modifies or invalidates the descriptor concurrently, the unprotected read can observe a torn or freed pointer. The result is a race condition classified as a locking flaw with memory-safety consequences. Exploitation from a local context can lead to kernel memory corruption, information disclosure, or system crash.

Root Cause

The root cause is a missing lock acquisition around a pointer dereference. The dev->desc field is protected by bus->lock, but the affected function reads it directly. The fix substitutes dev->bus, which is guaranteed valid for the device lifetime and does not require locking. This eliminates both the race window and the lock requirement.

Attack Vector

Exploitation requires local access with low privileges on a system exposing the i3c device interface. An attacker triggers repeated calls to the vulnerable code path while inducing concurrent bus state changes to widen the race window. See the upstream commits 251db58324ea and 8bed7f4fa710 for the patch details.

Detection Methods for CVE-2026-80954

Indicators of Compromise

Unexpected kernel oops or panic messages referencing i3c_device_get_supported_xfer_mode in dmesg or /var/log/kern.log.
KASAN or UBSAN reports flagging use-after-free or invalid pointer access within the i3c subsystem.
Repeated ioctl or sysfs access patterns against /sys/bus/i3c/ from non-privileged user contexts.

Detection Strategies

Inventory running kernel versions using uname -r and compare against distribution advisories for the i3c fix.
Enable kernel lockdep and KASAN in test environments to identify the unlocked dereference during fuzzing.
Monitor process telemetry for unusual local processes performing high-frequency i3c device interactions.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on i3c subsystem faults.
Track privilege boundary crossings and syscall anomalies from user processes accessing bus devices.
Correlate kernel crash telemetry with recent local logon activity to identify potential exploitation attempts.

How to Mitigate CVE-2026-80954

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commits 251db58324ea and 8bed7f4fa710.
Update to a kernel version from your distribution vendor that includes the i3c fix.
Restrict local user access on multi-tenant systems until patching completes.

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Reference the commits 251db58324ea4792c3f9f692ab09be148e051969 and 8bed7f4fa710914b7f05fd59998316bfb4d43385. The patch replaces dev->desc with dev->bus inside i3c_device_get_supported_xfer_mode(), removing the unlocked dereference and eliminating the race.

Workarounds

Disable the i3c kernel module with modprobe -r i3c_master on systems that do not require i3c bus functionality.
Blocklist i3c drivers in /etc/modprobe.d/ to prevent automatic loading at boot.
Restrict permissions on /sys/bus/i3c/ and related device nodes to root only.

bash

# Configuration example
echo 'blacklist i3c_master' | sudo tee /etc/modprobe.d/blacklist-i3c.conf
sudo modprobe -r i3c_master 2>/dev/null || true
sudo update-initramfs -u