Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-14367— I3C IBI work-node free-list data race between ISR and workqueue thread

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

位于 中的 I3C IBI（中断前中断）子系统通过一个名为 的无锁空闲链表来分发静态分配的工作节点，该链表由普通的 实现，不提供任何同步机制。分配辅助函数（ 、 、 、 、 ）直接从中断服务例程（ISR）上下文调用 ，而工作队列处理函数 则从工作队列线程中通过 归还节点，且两侧均未使用锁保护。 由于 和 既非原子操作也不具备中断安全性，当 IBI 中断在工作队列线程执行 操作的中途触发（或在启用 时发生真正的并行访问）时，会在共享链表上产生竞争条件。这会破坏链表链接：一个节点可能被同时交给两个消费者，节点可能丢失，

CVSS 3.1 · Low

Possible ATT&CK Techniques 1 AI

T1401

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 3.2.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-14367

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
I3C IBI work-node free-list data race between ISR and workqueue thread
Source: CVE Program / CVE List V5
Vulnerability Description
The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a plain sys_slist_t, which provides no synchronization. The allocation helpers (i3c_ibi_work_enqueue, i3c_ibi_work_enqueue_target_irq, i3c_ibi_work_enqueue_hotjoin, i3c_ibi_work_enqueue_controller_request, i3c_ibi_work_enqueue_cb) called sys_slist_get() directly from ISR context, while the workqueue handler i3c_ibi_work_handler() returned nodes with sys_slist_append() from the workqueue thread, with no lock on either side. Because sys_slist_get() and sys_slist_append() are neither atomic nor interrupt-safe, an IBI interrupt that fires while the workqueue thread is mid-append (or a truly parallel access under CONFIG_SMP) races on the shared list. This corrupts the list linkage: a node may be handed to two consumers, a node may be lost, or the head/tail pointers may be left inconsistent so sys_slist_get() returns a stale or garbage pointer. In the double-hand-out case the subsequent memcpy(ibi_node, ibi_work, sizeof(*ibi_node)) overwrites a node still in flight; a garbage pointer turns the same memcpy into an out-of-bounds write. The race is driven by I3C bus traffic — IBIs, hot-joins, and controller-role requests originate from target devices on the bus, and I3C supports hot-joining devices. An attacker controlling an I3C peripheral on the board's chip-to-chip bus can generate high-frequency interrupts timed to collide with the free operation. Exploitation requires physical access to the bus and winning a narrow timing window; the most realistic impact is a crash or hang (denial of service), with memory corruption possible but hard to control. The fix wraps all free-list sys_slist_get()/sys_slist_append() operations in the new ibi_work_alloc()/ibi_work_free() helpers, each guarded by a k_spinlock (ibi_work_lock), closing the race across ISR and thread contexts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 3.2.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-14367

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-14367

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-14367 (1)

Vendor Advisories for CVE-2026-14367 (1)

Same Patch Batch · zephyrproject · 2026-08-31 · 5 CVEs total

CVE-2026-14696 6.5 MEDIUM Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion
CVE-2026-14697 6.5 MEDIUM IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service
CVE-2026-14366 6.4 MEDIUM SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt
CVE-2026-14368 5.4 MEDIUM Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-362

V. Comments for CVE-2026-14367

No comments yet

Leave a comment