CVE-2026-89728: Linux Kernel I3C Buffer Overflow Vulnerability

CVE-2026-89728 Overview

CVE-2026-89728 is an out-of-bounds access vulnerability in the Linux kernel's Renesas I3C controller driver. The flaw resides in the Dynamic Address Assignment (DAA) handling logic within the i3c/renesas driver. When software initiates DAA, the controller reports results through the Normal Response Queue Port Register (NRSPQP). The data length field indicates the number of devices remaining after DAA, and reports the maximum supported value (8 for the Renesas controller) when the bus is empty. Improper bounds checking when calculating the newdevs bitmask leads to out-of-bounds memory access on empty buses.

Critical Impact
An out-of-bounds access in the kernel I3C driver can cause memory corruption or system instability on Renesas platforms with empty I3C buses.

Affected Products

Linux kernel with the Renesas I3C controller driver enabled
Systems using Renesas I3C hardware (up to 8 devices)
Distributions shipping the affected i3c/renesas driver prior to the referenced fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89728 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89728

Vulnerability Analysis

The Renesas I3C controller driver processes DAA results by reading the response descriptor from the NRSPQP register. The descriptor's data length field reports how many devices remain to be addressed after DAA completes. On an empty bus, this field returns the controller maximum of 8.

The driver uses this value to compute a bitmask identifying newly discovered devices. When the value equals the maximum supported device count, the bitmask calculation exceeds the intended array bounds. This triggers an out-of-bounds access [CWE-125/CWE-787] in kernel space during I3C bus probing or reset operations.

The fix, applied in commits 50dec95c9d1f and 769f5a233efc, adjusts the condition that computes the newdevs mask so it correctly handles the empty-bus case.

Root Cause

The root cause is a missing boundary check when interpreting the response descriptor length field. The driver assumed the remaining device count would always be less than the maximum supported, but the hardware reports the maximum value on an empty bus. Using this value directly in bitmask arithmetic produces indexes outside allocated storage.

Attack Vector

Exploitation requires local access to a system with the Renesas I3C controller driver loaded and an I3C bus in an empty state. The condition is primarily reachable through normal driver initialization or bus reset paths rather than remote input. Impact is limited to systems with the specific Renesas hardware and driver configuration.

No verified public exploit code is available. See the referenced kernel commits for the exact patch context.

Detection Methods for CVE-2026-89728

Indicators of Compromise

Kernel log messages referencing i3c driver faults, KASAN reports, or out-of-bounds warnings from the renesas I3C module
Unexpected kernel oops or panic events during I3C bus initialization on Renesas platforms
Repeated device probe failures on empty I3C buses

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface out-of-bounds access in the i3c/renesas driver
Audit installed kernel packages against the fix commits 50dec95c9d1f and 769f5a233efc
Monitor dmesg output for warnings originating from the Renesas I3C driver during boot

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on i3c subsystem faults
Track kernel versions across the fleet to identify hosts still running vulnerable driver code
Include I3C driver stability tests in platform validation for Renesas-based hardware

How to Mitigate CVE-2026-89728

Immediate Actions Required

Identify systems running the Renesas I3C controller driver and inventory affected kernel versions
Apply the upstream kernel patches referenced in the fix commits as soon as vendor updates are available
Prioritize embedded and industrial systems using Renesas I3C hardware for remediation

Patch Information

The issue is resolved upstream in the Linux kernel through commits 50dec95c9d1f1f82819bc898ef2b60fa83fd4ccd and 769f5a233efcf8587f70fb2244a202d88582c746. Rebuild or update kernels to include both commits, or install a distribution kernel that incorporates them.

Workarounds

Unload the i3c/renesas driver on systems that do not require I3C functionality
Disable the driver at build time by removing CONFIG_I3C_RENESAS (or the equivalent option) from the kernel configuration
Avoid initializing empty I3C buses on affected platforms until patches are applied

bash

# Verify whether the Renesas I3C driver is loaded
lsmod | grep -i i3c

# Temporarily unload the driver if it is not required
sudo modprobe -r i3c_renesas

# Prevent the module from loading at boot
echo 'blacklist i3c_renesas' | sudo tee /etc/modprobe.d/blacklist-i3c-renesas.conf