Look up another CVE · open CVE-2026-43352 in the interactive tracker
CVE-2026-43352
i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
Published 2026-05-08 (5 months ago) by the Linux kernel CNA. Subsystem drivers/i3c. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-43352 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 6.19.10-1 | Update the kernel and reboot. Fixed in 6.19.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.19.10-1 | Update the kernel and reboot. Fixed in 6.19.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The logic used to abort the DMA ring contains several flaws: 1. The driver unconditionally issues a ring abort even when the ring has already stopped. 2. The completion used to wait for abort completion is never re-initialized, resulting in incorrect wait behavior. 3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which resets hardware ring pointers and disrupts the controller state. 4. If the ring is already stopped, the abort operation should be considered successful without attempting further action. Fix the abort handling by checking whether the ring is running before issuing an abort, re-initializing the completion when needed, ensuring that RING_CTRL_ENABLE remains asserted during abort, and treating an already stopped ring as a successful condition.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/i3c/master/mipi-i3c-hci/dma.c
- What this is
- I3C SUBSYSTEMMAINTAINERS section matched on drivers/i3c/ · linux-i3c@lists.infradead.org · Maintained
- Kernel module
- none to look for. The file would have gone into mipi_i3c_hci, and Debian does not compile it into that module, so finding mipi_i3c_hci in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_I3C|CONFIG_MIPI_I3C_HCI' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_I3C, CONFIG_MIPI_I3C_HCI
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-05-08 (5 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/i3c
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.11 | 6.18.19 | 003df94bcc92 |
| 5.11 | 6.19.9 | 5549611888f5 |
| 5.11 | 7.0 | b795e68bf307 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable DMA dequeue path is reached through local I3C/I2C transfer paths on a system with MIPI I3C HCI hardware, including kernel I3C client drivers and the i2c-dev ioctl path. It is not reachable through network packets or a remotely exposed protocol.
- AC:LAttack complexity, low
- A local attacker who can initiate transfers can force timeout/error handling, for example by setting aggressive I2C adapter timeouts and issuing transfers, causing the dequeue abort path to run. The trigger does not depend on an uncontrollable race or rare memory layout.
- PR:LPrivileges required, low
- The practical attacker needs local access to an exposed I2C/I3C transfer interface or low-privilege access to driver operations that initiate I3C transfers. No init-namespace root-only capability gate or user-namespace-mediated privilege path is required for the core vulnerable path.
- UI:NUser interaction, none
- Once the attacker has local access to the relevant transfer interface, exploitation does not require another user to perform an action. The attacker can repeatedly issue the triggering transfers themselves.
- S:UScope, unchanged
- The vulnerability corrupts or disrupts kernel/controller state within the same host security authority. It does not constitute a VM escape or a demonstrated IOMMU/security-scope bypass.
- C:HConfidentiality impact, high
- The faulty abort handling can fail to stop DMA correctly and can unmap/free transfer buffers while hardware may still be writing, creating a plausible kernel memory corruption primitive. Under the required higher-severity rule, this is scored as potentially enabling high-impact information disclosure.
- I:HIntegrity impact, high
- Incorrectly aborting and restarting the DMA ring can leave hardware DMA active against stale or reused memory and corrupt kernel data structures. Such DMA-after-unmap memory corruption is defensibly treated as high integrity impact because it may be shaped into arbitrary kernel memory modification or control-flow compromise.
- A:HAvailability impact, high
- The bug can disrupt the controller state, trigger WARN_ON paths, hang transfers, and plausibly corrupt kernel memory through continued DMA after a failed abort. This supports high availability impact due to kernel crash, hang, or persistent device failure.