Linux Kernel CVE-2026-72454

Exploitation requires all of the following: local access with at least low-privilege code execution on the target; the target system must have a MIPI I3C HCI-compatible bus controller physically present with the mipi-i3c-hci kernel driver loaded and active; the running kernel version must fall within the affected commit range (prior to fix commits on the respective stable branches); and In-Band Interrupt processing must race concurrently with I3C device addition or removal - a timing-dependent condition. The requirement for specific I3C hardware and an active hotplug race window substantially limits the realistic attack surface. Systems without I3C hardware, those that do not load the driver, or those running patched kernels are not exploitable. Remote exploitation is not possible; the attack vector is strictly local.

The CVSS 7.8 High rating reflects the potential for complete kernel compromise (C:H/I:H/A:H) with only local, low-privilege access - a meaningful score on paper. However, real-world exploitation probability is significantly dampened by several factors: EPSS sits at just 0.16% (6th percentile), the vulnerability is not listed in CISA KEV, no public exploit or POC has been identified, and exploitation requires a system that both runs the MIPI I3C HCI kernel driver and experiences concurrent I3C device hotplug activity during the race window - a combination essentially limited to embedded and mobile hardware environments. Even a mid-sized municipal IT team in tczew managing conventional Linux server or desktop infrastructure would find this vulnerability irrelevant to their fleet unless deploying I3C-enabled SoC hardware. The NVD-assigned attack complexity of AC:L may be slightly optimistic: winning a kernel race condition without a reliable primitive typically requires repeated attempts or a mechanism that influences scheduling, which in practice raises exploitation difficulty - hence this analysis independently assesses AC:H. SSVC signals point to a 'Track' disposition: no active exploitation confirmed, no automation at scale, and limited technical impact outside specialized hardware deployments.

A local attacker with a low-privilege shell on an embedded Linux system equipped with a MIPI I3C HCI bus controller repeatedly triggers I3C device enumeration or removal - for example by hot-plugging I3C peripherals or manipulating device registration paths - while the kernel's IRQ handler concurrently processes In-Band Interrupts. The race causes i3c_hci_addr_to_dev() to dereference a pointer to a device struct that has just been freed by the I3C core, yielding either a kernel oops (denial of service) or, with a refined use-after-free primitive, a potential privilege escalation to root. No public POC exists at time of analysis.