Vulnerability-Lookup

FKIE_CVE-2026-80953

Vulnerability from fkie_nvd - Published: 2026-09-11 20:19 - Updated: 2026-09-13 07:17

Severity

8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A pending CMDR interrupt can therefore run adi_i3c_master_irq() and take master->xferqueue.lock before the dynamic lock has been initialized. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the probe ordering and the IRQ path adi_i3c_master_probe() -> adi_i3c_master_irq() -> xferqueue.lock, with a pending CMDR interrupt arriving after REG_IRQ_PENDING_CMDR is unmasked. Lockdep reported: INFO: trying to register non-static key. you didn't initialize this object before use? lock_acquire+0xbb/0x290 _raw_spin_lock_irqsave+0x36/0x60 adi_i3c_master_irq+0x32/0x56 [vuln_msv] adi_i3c_master_probe+0x5a/0xf47 [vuln_msv] Initialize the transfer queue and IBI state before requesting and unmasking the IRQ.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8a53f9102a0d3eeb8784999f925028acf339c276
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a15a1b95de980362c14f32f519b293b0d12ce86f
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/de8c32b0a246bbb4b44ec29e12769496a0bf66f7

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i3c/master/adi-i3c-master.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a15a1b95de980362c14f32f519b293b0d12ce86f",
              "status": "affected",
              "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086",
              "versionType": "git"
            },
            {
              "lessThan": "de8c32b0a246bbb4b44ec29e12769496a0bf66f7",
              "status": "affected",
              "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086",
              "versionType": "git"
            },
            {
              "lessThan": "8a53f9102a0d3eeb8784999f925028acf339c276",
              "status": "affected",
              "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i3c/master/adi-i3c-master.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: adi: initialize the lock before enabling interrupts\n\nadi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR\nbefore the controller\u0027s IBI state, transfer queue list and transfer\nqueue lock are initialized.  A pending CMDR interrupt can therefore run\nadi_i3c_master_irq() and take master-\u003exferqueue.lock before the dynamic\nlock has been initialized.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the probe ordering and the IRQ path\nadi_i3c_master_probe() -\u003e adi_i3c_master_irq() -\u003e xferqueue.lock, with a\npending CMDR interrupt arriving after REG_IRQ_PENDING_CMDR is unmasked.\nLockdep reported:\n\n  INFO: trying to register non-static key.\n  you didn\u0027t initialize this object before use?\n  lock_acquire+0xbb/0x290\n  _raw_spin_lock_irqsave+0x36/0x60\n  adi_i3c_master_irq+0x32/0x56 [vuln_msv]\n  adi_i3c_master_probe+0x5a/0xf47 [vuln_msv]\n\nInitialize the transfer queue and IBI state before requesting and\nunmasking the IRQ."
    }
  ],
  "id": "CVE-2026-80953",
  "lastModified": "2026-09-13T07:17:02.463",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-11T20:19:01.040",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8a53f9102a0d3eeb8784999f925028acf339c276"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a15a1b95de980362c14f32f519b293b0d12ce86f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/de8c32b0a246bbb4b44ec29e12769496a0bf66f7"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-80953 (GCVE-0-2026-80953)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-13 06:28

Title

i3c: master: adi: initialize the lock before enabling interrupts

Summary

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/a15a1b95de980362c…
https://git.kernel.org/stable/c/de8c32b0a246bbb4b…
https://git.kernel.org/stable/c/8a53f9102a0d3eeb8…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086 , < a15a1b95de980362c14f32f519b293b0d12ce86f (git) Affected: a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086 , < de8c32b0a246bbb4b44ec29e12769496a0bf66f7 (git) Affected: a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086 , < 8a53f9102a0d3eeb8784999f925028acf339c276 (git)
Linux	Linux	Affected: 6.18 Unaffected: 0 , < 6.18 (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i3c/master/adi-i3c-master.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a15a1b95de980362c14f32f519b293b0d12ce86f",
              "status": "affected",
              "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086",
              "versionType": "git"
            },
            {
              "lessThan": "de8c32b0a246bbb4b44ec29e12769496a0bf66f7",
              "status": "affected",
              "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086",
              "versionType": "git"
            },
            {
              "lessThan": "8a53f9102a0d3eeb8784999f925028acf339c276",
              "status": "affected",
              "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i3c/master/adi-i3c-master.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: adi: initialize the lock before enabling interrupts\n\nadi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR\nbefore the controller\u0027s IBI state, transfer queue list and transfer\nqueue lock are initialized.  A pending CMDR interrupt can therefore run\nadi_i3c_master_irq() and take master-\u003exferqueue.lock before the dynamic\nlock has been initialized.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the probe ordering and the IRQ path\nadi_i3c_master_probe() -\u003e adi_i3c_master_irq() -\u003e xferqueue.lock, with a\npending CMDR interrupt arriving after REG_IRQ_PENDING_CMDR is unmasked.\nLockdep reported:\n\n  INFO: trying to register non-static key.\n  you didn\u0027t initialize this object before use?\n  lock_acquire+0xbb/0x290\n  _raw_spin_lock_irqsave+0x36/0x60\n  adi_i3c_master_irq+0x32/0x56 [vuln_msv]\n  adi_i3c_master_probe+0x5a/0xf47 [vuln_msv]\n\nInitialize the transfer queue and IBI state before requesting and\nunmasking the IRQ."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached from adi_i3c_master_probe() on the Analog Devices AXI/FPGA I3C platform driver, which unmasks REG_IRQ_PENDING_CMDR so adi_i3c_master_irq() runs during local boot, module load, or driver rebind; there is no network, Bluetooth, or USB packet path into this controller.\nAC:L - Unmasking CMDR with leftover pending controller state causes adi_i3c_master_irq() to run immediately and take xferqueue.lock before spin_lock_init(); stale post-reset or warm-reboot interrupt bits make this deterministic without an attacker-uncontrollable race or heap layout.\nPR:N - adi_i3c_master_probe() performs no capability or authentication checks before request_irq() and unmasking CMDR; on FPGA/SoC boards with this IP the vulnerable probe runs automatically at kernel boot without the attacker holding Linux privileges.\nUI:N - No victim action is required; a pending CMDR interrupt during driver probe at boot or reboot invokes the uninitialized-lock IRQ path without anyone opening I3C/I2C device nodes or configuring transfers.\nS:U - Impact is kernel lock and memory corruption inside the host kernel that owns the I3C master; this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - adi_i3c_master_irq() takes the uninitialized xferqueue.lock in hard-IRQ context and may also process leftover IBI/DAA pending bits while ibi.slots is still NULL, which is undefined lock/pointer behavior that can be leveraged for kernel memory disclosure.\nI:H - Concurrent spin_lock_init() versus IRQ-context use of the same dynamic lock, plus IBI handling through a NULL slots table, can corrupt lock metadata and adjacent driver/heap state, enabling a write or control-flow primitive under conservative kernel CNA scoring.\nA:H - The commit\u0027s lockdep PoC already shows lock_acquire on a non-static key from adi_i3c_master_irq() during probe; DEBUG_SPINLOCK BUG, oops/panic, or a hung IRQ path on affected FPGA/embedded boards is full availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:28:26.721Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a15a1b95de980362c14f32f519b293b0d12ce86f"
        },
        {
          "url": "https://git.kernel.org/stable/c/de8c32b0a246bbb4b44ec29e12769496a0bf66f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a53f9102a0d3eeb8784999f925028acf339c276"
        }
      ],
      "title": "i3c: master: adi: initialize the lock before enabling interrupts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80953",
    "datePublished": "2026-09-11T19:42:22.515Z",
    "dateReserved": "2026-08-26T14:34:25.804Z",
    "dateUpdated": "2026-09-13T06:28:26.721Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.