Linux Kernel up to 7.1.4 mipi-i3c-hci core.c i3c_hci_addr_to_dev use after free

Summaryinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.1.4. The impacted element is the function i3c_hci_addr_to_dev of the file core.c of the component mipi-i3c-hci. Such manipulation leads to use after free. This vulnerability is referenced as CVE-2026-72454. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.1.4. Affected by this issue is the function i3c_hci_addr_to_dev of the file core.c of the component mipi-i3c-hci. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() i3c_hci_addr_to_dev() walks bus->devs.i3c, which is protected by bus.lock (rwsem). However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent device addition/removal in the I3C core to modify the list while it is being traversed, potentially leading to use-after-free or crashes. Remove the dependency on the bus device list and introduce a dedicated lookup table. Add an ibi_devs[] array indexed by DAT entry, maintained under hci->lock. Update the array when IBIs are enabled or disabled, so that it always reflects the set of devices allowed to generate IBIs. Also update when IBIs are freed, to cover the corner case when an IBI is freed without first being disabled (e.g. oldedev in i3c_master_add_i3c_dev_locked()). Move i3c_hci_addr_to_dev() into core.c, reimplement it using the new array, and add a lockdep assertion to enforce that hci->lock is held by callers. Demote a message in PIO and DMA IBI handling, from an error to a debug message, because there is a race window when the condition can arise normally.

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2026-72454 since 08/09/2026. The exploitation is known to be easy. The attack needs to be approached locally. The exploitation requires an enhanced level of successful authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/15/2026).

Upgrading to version 7.1.5 or 7.2-rc1 eliminates this vulnerability. Applying the patch 8f851cab401c28287d536b1347d76f6e219c0db6/650716f23eac488c6696babdc7805f6a6b7427ad is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion