EUVD-2026-76277
GHSA-5fmf-26vf-rg68
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires winning specific timing window (AC:H); local low-privilege user required; full kernel impact only if use-after-free is successfully converted to code execution.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode()
i3c_device_get_supported_xfer_mode() uses dev->desc to obtain the master controller. However, dev->desc must not be dereferenced unless bus->lock is held, and this function does not take that lock.
The function only needs access to the master controller associated with the device's bus. Use dev->bus instead, which is always valid for the lifetime of the device and does not require dereferencing dev->desc.
AnalysisAI
Unlocked dereference of dev->desc in the Linux kernel's i3c subsystem exposes systems with i3c-capable hardware to potential use-after-free or null pointer dereference conditions when a local low-privileged user races device descriptor teardown against calls to i3c_device_get_supported_xfer_mode(). The function accesses dev->desc to resolve the master controller without holding the required bus->lock, meaning a concurrent device detachment can free or null that pointer mid-access, leading to kernel memory corruption with CVSS-assessed C:H/I:H/A:H impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a local, low-privileged user account with access to an i3c character device node; (2) the target system must have i3c bus hardware physically present and the i3c kernel module loaded - systems without i3c hardware or with the module absent/blacklisted are entirely unaffected; (3) the attacker must win a concurrency race between device descriptor teardown and the transfer mode query, which imposes a timing constraint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is bounded by two key gatekeepers: the attacker must have local shell access (AV:L/PR:L), and the target system must have i3c bus hardware present with the i3c subsystem actively loaded - a condition that applies to select mobile SoCs and embedded platforms but not to the vast majority of general-purpose Linux servers or desktops. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to Linux kernel 7.2.4 (stable release) or 7.3-rc1, which incorporate the fix replacing the unlocked dev->desc dereference with dev->bus access. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems with i3c hardware (primarily embedded devices, IoT platforms, and specific automotive systems) and determine which are running vulnerable Linux kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today