Linux Kernel EUVD-2026-28658

Requires local authenticated access with low-level user privileges (PR:L) to a Linux system where the mipi-i3c-hci driver is loaded and MIPI I3C Host Controller Interface hardware is present and operational. The attacker must be able to trigger DMA dequeue operations through either direct device interaction (via /dev/i3c-* character devices if exposed to unprivileged users, which is non-default) or through privileged processes that accept attacker-controlled input affecting I3C operations. The vulnerability affects the kernel driver regardless of specific I3C peripheral devices connected. Exploitation is LIMITED to systems with actual I3C hardware - the vast majority of server and desktop Linux deployments do not include MIPI I3C controllers and are therefore not vulnerable. Mobile devices, embedded systems, and IoT platforms are primary risk candidates. Default kernel configurations do not expose I3C device nodes to unprivileged users, requiring either system-level access or exploitation chaining through another vulnerability affecting a privileged I3C-interacting process.

The CVSS 7.8 score reflects Local attack vector with Low complexity and Low privileges required, indicating any authenticated local user can trigger the vulnerability without special access. However, real-world risk assessment reveals more nuanced factors. The EPSS score of 0.02% (4th percentile) suggests extremely low probability of widespread exploitation, likely because MIPI I3C hardware is primarily found in specialized embedded systems, IoT devices, and mobile platforms rather than general-purpose servers or desktops. The vulnerability is NOT listed in CISA KEV, confirming no confirmed active exploitation. The high CVSS impact ratings (C:H/I:H/A:H) are theoretically concerning, but practical exploitation requires both physical/local access to a system with I3C hardware AND the ability to interact with the specific DMA ring management interface, which is typically restricted to privileged system processes or specialized userspace drivers. The Information Disclosure tag combined with the DMA context suggests potential memory corruption scenarios where ring pointer corruption could expose kernel memory contents or allow controlled memory overwrites. Patches are available from the vendor across multiple stable kernel branches (6.18.19, 6.19.9, 7.0), significantly reducing window of exposure for maintained systems. Priority should be MODERATE for embedded/IoT device manufacturers using affected kernel versions, but LOW for general enterprise Linux deployments where I3C hardware is uncommon. The absence of public exploit code further lowers immediate risk, though the detailed technical description in the CVE provides sufficient information for capable adversaries to develop exploits.

An attacker with local authenticated access to an embedded Linux device (such as a mobile handset, IoT gateway, or industrial controller) utilizing MIPI I3C hardware attempts to trigger the flawed DMA ring abort sequence through repeated I3C device operations or direct ioctl calls to the I3C character device. By forcing the driver into the abort path when the ring is already stopped, the attacker causes the kernel to incorrectly clear RING_CTRL_ENABLE, corrupting DMA ring pointers and potentially exposing kernel memory contents through the information disclosure vector. No public POC exists at time of analysis.