Linux Kernel EUVD-2026-28659

Exploitation requires authenticated local shell access (PR:L indicates low privilege user sufficient), an active I3C Host Controller Interface using the mipi-i3c-hci driver (CONFIG_I3C_HCI kernel option enabled), and physical or emulated I3C hardware attached to the system. The attacker must trigger near-simultaneous I3C transfer timeouts to race the DMA dequeue function, requiring ability to interact with I3C device nodes (typically /dev/i3c-* or via I3C subsystem APIs) and precise timing control. Systems without I3C hardware, with the driver disabled, or where local access is restricted are not exploitable. The race window is narrow, requiring multiple concurrent timeout events, which limits opportunistic exploitation but does not prevent determined attackers with appropriate hardware access from achieving reliable triggering.

Real-world risk is moderate despite the high CVSS 7.8 score. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low attack complexity and low privileges required, meaning an authenticated local user can trigger the vulnerability. However, multiple factors reduce practical exploitability: the attacker must have local shell access, the system must have I3C hardware and the mipi-i3c-hci driver loaded (relatively uncommon outside specialized embedded/IoT systems), and precise race condition timing is required to achieve exploitable memory corruption rather than just a crash. The EPSS score of 0.02% (4th percentile) aligns with this assessment, indicating minimal observed exploitation activity. No CISA KEV listing, no public POC, and the niche nature of I3C hardware support further limit exposure. Priority should be moderate for systems actually using I3C peripherals (industrial IoT, mobile SoCs with I3C sensors), but low for general-purpose servers and desktops where the affected driver is unlikely to be active. Patch availability across stable kernel branches enables straightforward remediation for affected deployments.

A malicious local user with shell access on a Linux system using I3C peripherals (e.g., embedded device with I3C sensors) repeatedly triggers I3C transfer timeouts through malformed ioctl calls or by manipulating device timing. By carefully timing multiple concurrent timeout events, the attacker races the unprotected hci_dma_dequeue_xfer() function, corrupting DMA ring state. This memory corruption allows the attacker to escalate privileges to root by hijacking kernel execution flow or to crash the system for denial of service. No public POC exists, but race condition exploitation techniques are well-documented for skilled attackers.