CVE-2026-43353 PUBLISHED

i3c: mipi-i3c-hci: Fix race in DMA ring dequeue

Assigner: Linux
Reserved: 01.05.2026 Published: 08.05.2026 Updated: 08.05.2026

In the Linux kernel, the following vulnerability has been resolved:

i3c: mipi-i3c-hci: Fix race in DMA ring dequeue

The HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for multiple transfers that timeout around the same time. However, the function is not serialized and can race with itself.

When a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes incomplete transfers, and then restarts the ring. If another timeout triggers a parallel call into the same function, the two instances may interfere with each other - stopping or restarting the ring at unexpected times.

Add a mutex so that hci_dma_dequeue_xfer() is serialized with respect to itself.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 9ad9a52cce2828d932ae9495181e3d6414f72c07 to b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e (excl.)
  • affected from 9ad9a52cce2828d932ae9495181e3d6414f72c07 to 4faa1e9c67a2229f6749190aedaf88ce0391efd2 (excl.)
  • affected from 9ad9a52cce2828d932ae9495181e3d6414f72c07 to 1dca8aee80eea76d2aae21265de5dd64f6ba0f09 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 5.11 is affected
  • unaffected from 0 to 5.11 (excl.)
  • unaffected from 6.18.19 to 6.18.* (incl.)
  • unaffected from 6.19.9 to 6.19.* (incl.)
  • unaffected from 7.0 to * (incl.)

References