{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43352", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.004Z", "datePublished": "2026-05-08T14:21:09.552Z", "dateUpdated": "2026-08-05T12:27:26.003Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:27:26.003Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue\n\nThe logic used to abort the DMA ring contains several flaws:\n\n 1. The driver unconditionally issues a ring abort even when the ring has\n already stopped.\n 2. The completion used to wait for abort completion is never\n re-initialized, resulting in incorrect wait behavior.\n 3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which\n resets hardware ring pointers and disrupts the controller state.\n 4. If the ring is already stopped, the abort operation should be\n considered successful without attempting further action.\n\nFix the abort handling by checking whether the ring is running before\nissuing an abort, re-initializing the completion when needed, ensuring that\nRING_CTRL_ENABLE remains asserted during abort, and treating an already\nstopped ring as a successful condition." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable DMA dequeue path is reached through local I3C/I2C transfer paths on a system with MIPI I3C HCI hardware, including kernel I3C client drivers and the i2c-dev ioctl path. It is not reachable through network packets or a remotely exposed protocol.\nAC:L - A local attacker who can initiate transfers can force timeout/error handling, for example by setting aggressive I2C adapter timeouts and issuing transfers, causing the dequeue abort path to run. The trigger does not depend on an uncontrollable race or rare memory layout.\nPR:L - The practical attacker needs local access to an exposed I2C/I3C transfer interface or low-privilege access to driver operations that initiate I3C transfers. No init-namespace root-only capability gate or user-namespace-mediated privilege path is required for the core vulnerable path.\nUI:N - Once the attacker has local access to the relevant transfer interface, exploitation does not require another user to perform an action. The attacker can repeatedly issue the triggering transfers themselves.\nS:U - The vulnerability corrupts or disrupts kernel/controller state within the same host security authority. It does not constitute a VM escape or a demonstrated IOMMU/security-scope bypass.\nC:H - The faulty abort handling can fail to stop DMA correctly and can unmap/free transfer buffers while hardware may still be writing, creating a plausible kernel memory corruption primitive. Under the required higher-severity rule, this is scored as potentially enabling high-impact information disclosure.\nI:H - Incorrectly aborting and restarting the DMA ring can leave hardware DMA active against stale or reused memory and corrupt kernel data structures. Such DMA-after-unmap memory corruption is defensibly treated as high integrity impact because it may be shaped into arbitrary kernel memory modification or control-flow compromise.\nA:H - The bug can disrupt the controller state, trigger WARN_ON paths, hang transfers, and plausibly corrupt kernel memory through continued DMA after a failed abort. This supports high availability impact due to kernel crash, hang, or persistent device failure." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/i3c/master/mipi-i3c-hci/dma.c" ], "versions": [ { "version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "lessThan": "003df94bcc9227e8e930abd03ac7f63ac10033dc", "status": "affected", "versionType": "git" }, { "version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "lessThan": "5549611888f5ca2db5e8e692b57f30626ddf9898", "status": "affected", "versionType": "git" }, { "version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "lessThan": "b795e68bf3073d67bebbb5a44d93f49efc5b8cc7", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/i3c/master/mipi-i3c-hci/dma.c" ], "versions": [ { "version": "5.11", "status": "affected" }, { "version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.19.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/003df94bcc9227e8e930abd03ac7f63ac10033dc" }, { "url": "https://git.kernel.org/stable/c/5549611888f5ca2db5e8e692b57f30626ddf9898" }, { "url": "https://git.kernel.org/stable/c/b795e68bf3073d67bebbb5a44d93f49efc5b8cc7" } ], "title": "i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue", "x_generator": { "engine": "bippy-1.2.0" } } } }