CVE-2026-97515 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845
On NPCM845, when a target on the I3C bus gets stuck holding SDA low, the controller reports a false Master Request (MR) in-band interrupt event. The driver handles this by emitting a STOP condition to restore the bus.
However, the hardware quirk SVC_I3C_QUIRK_FALSE_SLVSTART indicates that emitting a STOP condition may spuriously set the SLVSTART interrupt status bit. In the Master Request case, this creates a feedback loop: the STOP triggers a new SLVSTART event, the IRQ handler fires again, the controller still reports an MR type, another STOP is emitted, and the cycle repeats indefinitely, resulting in an IRQ storm that can lock up the CPU.
Clear the SLVSTART status bit explicitly after emitting the STOP in the Master Request IBI handler when the SVC_I3C_QUIRK_FALSE_SLVSTART quirk is set. This breaks the feedback loop without affecting normal SLVSTART processing, which is already guarded in the top-level IRQ handler by checking that MSTATUS is in SLVREQ state.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel driver for the Synopsys DesignWare I3C Master controller contains a critical logic flaw specific to the Nuvoton NPCM845 System on Chip, which can lead to system instability through an interrupt storm. The Inter-Integrated Circuit (I2C) extension bus is designed for high-speed communication between devices, and proper handling of bus errors is essential for maintaining system reliability. In this scenario, a hardware anomaly occurs when a target device on the I3C bus becomes stuck holding the Serial Data Line low. This physical state causes the controller to incorrectly report a false Master Request in-band interrupt event. The driver's standard recovery procedure involves emitting a STOP condition to attempt to restore normal bus operation and release the held line.
The core vulnerability arises from a specific hardware quirk identified as SVC_I3C_QUIRK_FALSE_SLVSTART, which is present on the NPCM845 platform. When the driver emits the corrective STOP condition in response to the false Master Request, this action spuriously sets the Slave Start interrupt status bit within the controller's registers. Because the interrupt handler does not immediately clear this spurious flag before exiting or re-evaluating conditions, it creates a dangerous feedback loop. The presence of the set SLVSTART bit triggers another interrupt event, causing the IRQ handler to fire again. Since the underlying hardware condition persists, the controller continues to report Master Request events, leading the driver to emit further STOP conditions. Each subsequent STOP inadvertently sets the SLVSTART status bit once more, perpetuating an infinite cycle of interrupts.
This uncontrolled loop results in a severe interrupt storm that consumes nearly all available CPU cycles dedicated to handling these specific hardware interrupts. The operational impact is significant, as the continuous servicing of this spurious interrupt chain prevents other critical system tasks from executing, effectively locking up the CPU and rendering the system unresponsive or causing it to crash entirely. This represents a denial-of-service condition triggered by external bus anomalies rather than malicious exploitation, though it highlights a lack of robustness in error recovery paths for embedded systems relying on this hardware interface.
The resolution involves modifying the interrupt handler logic within the I3C master service driver to explicitly clear the SLVSTART status bit immediately after emitting the STOP condition when the SVC_I3C_QUIRK_FALSE_SLV_START quirk is active and a Master Request event has been processed. This intervention breaks the feedback loop by ensuring that the spurious flag does not trigger subsequent interrupt servicing for this specific error path. The fix preserves normal SLVSTART processing because standard slave start events are already guarded in the top-level IRQ handler by verifying that the master status register is in the correct request state, thereby preventing false positives from affecting legitimate operations.
From a security and standards perspective, this vulnerability aligns with CWE-401, which describes missing release of memory or resources after effective use, although here it manifests as a failure to clear hardware interrupt flags leading to resource exhaustion. It also relates to CWE-835 regarding loops that consume excessive CPU time without progress. In the context of the MITRE ATT&CK framework for enterprise security, this behavior could be leveraged in an Impact category tactic such as T1496 Resource Hijacking if a physical attacker or compromised device on the bus intentionally induces the stuck SDA state to cause denial of service against the host processor. Mitigation strategies include applying the kernel patch that addresses the quirk handling and ensuring that embedded systems utilizing this controller have robust hardware-level protections, such as timeout mechanisms for I2C/I3C buses, to physically reset lines if software recovery fails.