EUVD-2026-76273
GHSA-74cf-jhfv-j2fx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition between timeout and interrupt makes AC:H accurate; primary realistic impact is kernel crash (A:H), with limited C/I given hardware-specific scope.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
i3c: renesas: Check that the transfer is valid before accessing it
The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion. The interrupt handler dequeues the transfer, updates/uses it, and signals the waiting thread.
If the completion times out, the waiting thread dequeues the transfer and free it. If an interrupt fires after that, the handler may access freed memory, leading to crashes.
Check that the transfer is still valid before accessing it in the interrupt handler. With it clear any status flags and disable all the interrupts to avoid triggering the same interrupts again.
AnalysisAI
Use-after-free in the Renesas I3C driver allows a local attacker with low privileges to crash the kernel or potentially escalate privileges on systems equipped with Renesas I3C hardware. The flaw stems from a race between a timed-out transfer cleanup path, which frees the transfer struct, and a late-arriving interrupt whose handler dereferences that now-freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local access with at least low-privilege user credentials on the target system; (2) the target system must be built on hardware with a Renesas I3C controller (e.g., Renesas RZ or R-Car SoC families); (3) the Renesas I3C master kernel driver must be loaded and functional; (4) the attacker must be able to trigger or observe I3C transfer timeout conditions, either directly by interacting with an I3C device or indirectly via system stress. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is constrained by several factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patches targeting Linux 7.2.4, 7.3-rc1, or 6.18.50 as appropriate for your kernel track. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems equipped with Renesas I3C hardware through asset inventory and device audits. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today