CVE-2026-80951

A flaw was found in the Linux kernel's I3C master driver. A malicious I3C device could exploit this by sending an In-Band Interrupt IBI payload that exceeds the allocated slot size. This can lead to an out-of-bounds write into the IBI pool, potentially causing memory corruption and system...

Linux Distros Unpatched Vulnerability : CVE-2026-80951

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is...

DEBIAN-CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

AZL-100136 CVE-2026-80951 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

UBUNTU-CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80951 i3c: master: svc: bound IBI payload to the requested max_payload_len

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80951

CVE-2026-80951 is an out-of-bounds write in the Linux kernel's i3c master svc driver. The function svc_i3c_master_handle_ibi() reads IBI payloads from the RX FIFO, but its loop is bounded by the hardware FIFO size rather than the per-slot max_payload_len . When a device sends more bytes than the ...

EUVD-2026-76274

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

CVE-2026-80951 i3c: master: svc: bound IBI payload to the requested max_payload_len

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...

PT-2026-90081

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested max payload len svc i3c master handle ibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVC I3C FIFO SIZE, not by the...

CVE-2026-14367

The I3C IBI subsystem in drivers/i3c/i3cibiworkq.c hands out statically-allocated work nodes through a free-list i3cibiworknodesfree implemented as a plain sysslistt, which provides no synchronization. The allocation helpers i3cibiworkenqueue, i3cibiworkenqueuetargetirq, i3cibiworkenqueuehotjoin,...

CVE-2026-14367 I3C IBI work-node free-list data race between ISR and workqueue thread

The I3C IBI subsystem in drivers/i3c/i3cibiworkq.c hands out statically-allocated work nodes through a free-list i3cibiworknodesfree implemented as a plain sysslistt, which provides no synchronization. The allocation helpers i3cibiworkenqueue, i3cibiworkenqueuetargetirq, i3cibiworkenqueuehotjoin,...

CVE-2026-14367 I3C IBI work-node free-list data race between ISR and workqueue thread

The I3C IBI subsystem in drivers/i3c/i3cibiworkq.c hands out statically-allocated work nodes through a free-list i3cibiworknodesfree implemented as a plain sysslistt, which provides no synchronization. The allocation helpers i3cibiworkenqueue, i3cibiworkenqueuetargetirq, i3cibiworkenqueuehotjoin,...

EUVD-2026-68718

The I3C IBI subsystem in drivers/i3c/i3cibiworkq.c hands out statically-allocated work nodes through a free-list i3cibiworknodesfree implemented as a plain sysslistt, which provides no synchronization. The allocation helpers i3cibiworkenqueue, i3cibiworkenqueuetargetirq, i3cibiworkenqueuehotjoin,...

CVE-2026-14367

CVE-2026-14367 affects the Zephyr RTOS I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c. A statically-allocated work-node free-list (sys_slist_t) is accessed without synchronization: ISR-context callers invoke sys_slist_get() while the workqueue thread calls sys_slist_append(). This data race can...

PT-2026-83952

The I3C IBI subsystem in drivers/i3c/i3c ibi workq.c hands out statically-allocated work nodes through a free-list i3c ibi work nodes free implemented as a plain sys slist t, which provides no synchronization. The allocation helpers i3c ibi work enqueue, i3c ibi work enqueue target irq, i3c ibi...

CVE-2026-72454

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3chciaddrtodev i3chciaddrtodev walks bus-devs.i3c, which is protected by bus.lock rwsem. However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent...