CVE-2026-43353

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable DMA dequeue path is reached through local kernel I3C/I2C transfer APIs, including userspace-triggerable device/client paths on systems exposing I3C-backed devices. There is no evidence of direct internet/network packet reachability for this HCI master driver.

AC:LAttack complexity, low

The I3C core explicitly permits parallel normal transfers, and the bug is a missing serialization primitive when multiple transfers time out together. An attacker who can trigger concurrent transfers can create the race rather than relying on an uncontrollable rare condition.

PR:LPrivileges required, low

Reaching the path requires local ability to cause I3C/I2C client transfers, such as access to exposed device interfaces or subsystem clients, but no kernel capability check is present in the vulnerable HCI dequeue logic itself. This is best treated as low local privilege rather than real administrator/root-only privilege.

UI:NUser interaction, none

Once the attacker can trigger the relevant transfers, no separate victim action is required. The timeout/dequeue handling runs in the kernel as part of transfer completion/error handling.

S:UScope, unchanged

The vulnerability corrupts or destabilizes kernel-controlled I3C HCI/DMA state within the same kernel security authority. It does not constitute a VM escape or an IOMMU/DMA isolation boundary bypass by itself.

C:HConfidentiality impact, high

The race can restart or manipulate a DMA ring while another dequeue path is still aborting, replacing descriptors, and unmapping DMA buffers, leaving hardware able to access stale or unintended kernel memory. Under the required overestimate rule, this DMA memory corruption is treated as capable of high confidentiality impact.

I:HIntegrity impact, high

The same stale descriptor/unmap race can allow device DMA or ring state corruption to write into unintended or freed kernel memory. That is a memory corruption primitive, so high integrity impact is defensible.

A:HAvailability impact, high

The vulnerable path can leave the DMA ring and host controller in an inconsistent state, trigger WARN/oops-like failure paths, or cause DMA/ring corruption. A kernel crash, hang, or persistent controller failure gives high availability impact.