EUVD-2026-76276
GHSA-8qpp-p36x-27xr
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise interrupt timing during probe (AC:H); no deliberate privilege needed but hardware must be physically present (AV:L/PR:N); kernel-space impact justifies C:H/I:H/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: adi: initialize the lock before enabling interrupts
adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A pending CMDR interrupt can therefore run adi_i3c_master_irq() and take master->xferqueue.lock before the dynamic lock has been initialized.
This issue was found by our static analysis tool and then manually reviewed against the current tree.
The grounded PoC kept the probe ordering and the IRQ path adi_i3c_master_probe() -> adi_i3c_master_irq() -> xferqueue.lock, with a pending CMDR interrupt arriving after REG_IRQ_PENDING_CMDR is unmasked. Lockdep reported:
INFO: trying to register non-static key. you didn't initialize this object before use? lock_acquire+0xbb/0x290 _raw_spin_lock_irqsave+0x36/0x60 adi_i3c_master_irq+0x32/0x56 [vuln_msv] adi_i3c_master_probe+0x5a/0xf47 [vuln_msv]
Initialize the transfer queue and IBI state before requesting and unmasking the IRQ.
AnalysisAI
Use-before-initialization race condition in the ADI I3C master driver of the Linux kernel allows a hardware interrupt to acquire an uninitialized spinlock during device probe. Specifically, adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the transfer queue lock and IBI state are initialized, so an early CMDR interrupt can invoke adi_i3c_master_irq() and attempt to take master->xferqueue.lock against an uninitialized dynamic key. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target system must have Analog Devices ADI I3C master controller hardware physically present and the adi-i3c kernel module loaded; (2) the vulnerable kernel version (within the affected commit range) must be running; (3) a CMDR hardware interrupt must arrive in the race window between IRQ registration and xferqueue.lock initialization during driver probe - this is a hardware-timing condition, not attacker-controlled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a base score of 8.4, but several metrics appear overstated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched Linux kernel release: 6.18.50 or later in the 6.18 stable series, or 7.2.4 or later in the 7.2 series, or any release at or after 7.3-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems running Linux kernels prior to 6.18.50 or 7.2.4 with ADI I3C hardware enabled by checking kernel version and verifying adi_i3c_master driver presence. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today