{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80953", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.804Z", "datePublished": "2026-09-11T19:42:22.515Z", "dateUpdated": "2026-09-11T19:42:22.515Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:42:22.515Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: adi: initialize the lock before enabling interrupts\n\nadi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR\nbefore the controller's IBI state, transfer queue list and transfer\nqueue lock are initialized. A pending CMDR interrupt can therefore run\nadi_i3c_master_irq() and take master->xferqueue.lock before the dynamic\nlock has been initialized.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the probe ordering and the IRQ path\nadi_i3c_master_probe() -> adi_i3c_master_irq() -> xferqueue.lock, with a\npending CMDR interrupt arriving after REG_IRQ_PENDING_CMDR is unmasked.\nLockdep reported:\n\n INFO: trying to register non-static key.\n you didn't initialize this object before use?\n lock_acquire+0xbb/0x290\n _raw_spin_lock_irqsave+0x36/0x60\n adi_i3c_master_irq+0x32/0x56 [vuln_msv]\n adi_i3c_master_probe+0x5a/0xf47 [vuln_msv]\n\nInitialize the transfer queue and IBI state before requesting and\nunmasking the IRQ."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i3c/master/adi-i3c-master.c"], "versions": [{"version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086", "lessThan": "a15a1b95de980362c14f32f519b293b0d12ce86f", "status": "affected", "versionType": "git"}, {"version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086", "lessThan": "de8c32b0a246bbb4b44ec29e12769496a0bf66f7", "status": "affected", "versionType": "git"}, {"version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086", "lessThan": "8a53f9102a0d3eeb8784999f925028acf339c276", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i3c/master/adi-i3c-master.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a15a1b95de980362c14f32f519b293b0d12ce86f"}, {"url": "https://git.kernel.org/stable/c/de8c32b0a246bbb4b44ec29e12769496a0bf66f7"}, {"url": "https://git.kernel.org/stable/c/8a53f9102a0d3eeb8784999f925028acf339c276"}], "title": "i3c: master: adi: initialize the lock before enabling interrupts", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/i3c/master/adi-i3c-master.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a15a1b95de980362c14f32f519b293b0d12ce86f", "status": "affected", "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086", "versionType": "git"}, {"lessThan": "de8c32b0a246bbb4b44ec29e12769496a0bf66f7", "status": "affected", "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086", "versionType": "git"}, {"lessThan": "8a53f9102a0d3eeb8784999f925028acf339c276", "status": "affected", "version": "a79ac2cdc91d6be3010f2e9a3b2a2ccfc26e2086", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/i3c/master/adi-i3c-master.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: adi: initialize the lock before enabling interrupts\n\nadi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR\nbefore the controller's IBI state, transfer queue list and transfer\nqueue lock are initialized. A pending CMDR interrupt can therefore run\nadi_i3c_master_irq() and take master->xferqueue.lock before the dynamic\nlock has been initialized.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the probe ordering and the IRQ path\nadi_i3c_master_probe() -> adi_i3c_master_irq() -> xferqueue.lock, with a\npending CMDR interrupt arriving after REG_IRQ_PENDING_CMDR is unmasked.\nLockdep reported:\n\n INFO: trying to register non-static key.\n you didn't initialize this object before use?\n lock_acquire+0xbb/0x290\n _raw_spin_lock_irqsave+0x36/0x60\n adi_i3c_master_irq+0x32/0x56 [vuln_msv]\n adi_i3c_master_probe+0x5a/0xf47 [vuln_msv]\n\nInitialize the transfer queue and IBI state before requesting and\nunmasking the IRQ."}], "id": "CVE-2026-80953", "lastModified": "2026-09-11T20:19:01.040", "metrics": {}, "published": "2026-09-11T20:19:01.040", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8a53f9102a0d3eeb8784999f925028acf339c276"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a15a1b95de980362c14f32f519b293b0d12ce86f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/de8c32b0a246bbb4b44ec29e12769496a0bf66f7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Denial of Service in i3c master due to uninitialized lock", "id": "2532115", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532115"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-909", "details": ["A flaw was found in the Linux kernel's i3c master driver. A race condition exists where the `adi_i3c_master_probe()` function requests an interrupt and unmasks a register before a critical lock (`xferqueue.lock`) is properly initialized. This allows a pending interrupt to attempt to acquire an uninitialized lock, which can lead to a kernel crash and a denial of service. This issue can be triggered by a local attacker."], "name": "CVE-2026-80953", "public_date": "2026-09-11T19:42:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80953\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80953\nhttps://git.kernel.org/stable/c/8a53f9102a0d3eeb8784999f925028acf339c276\nhttps://git.kernel.org/stable/c/a15a1b95de980362c14f32f519b293b0d12ce86f\nhttps://git.kernel.org/stable/c/de8c32b0a246bbb4b44ec29e12769496a0bf66f7"], "threat_severity": "Moderate"}

{"created": "2026-09-12T02:30:06.165971+00:00", "updated": "2026-09-12T02:30:06.165977+00:00", "vendors": []}