CVE-2026-80950— i3c: renesas: Check that the transfer is valid before accessing it
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux 内核中，以下漏洞已得到修复： i3c: renesas: 在访问传输结构前检查其有效性 瑞萨（Renesas）I3C 驱动程序采用异步模型进行数据传输。它首先准备一个 结构，将其加入队列，并等待完成。中断处理程序负责从队列中取出该传输结构，对其更新或使用，然后向等待的线程发送信号。 如果完成操作超时，等待的线程会从队列中取出该传输结构并释放其内存。如果在此之后中断被触发，中断处理程序可能会访问已释放的内存（use-after-free），从而导致系统崩溃。 修复措施： 在中断处理程序中，先检查该传输结构
Affected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | d028219a9f1485914492bf373406f6a0e665ace2< 0093f9fc102ba8b98561fdd2f8559553ef56be59 |
affected |
d028219a9f1485914492bf373406f6a0e665ace2< ec631aff93261c6d031f953549802322032f2aba |
affected | ||
d028219a9f1485914492bf373406f6a0e665ace2< 5f1a76ecfe90544a28d657306c9b3caa66ba0e63 |
affected | ||
6.17 |
affected | ||
< 6.17 |
unaffected | ||
6.18.50≤ 6.18.* |
unaffected | ||
7.2.4≤ 7.2.* |
unaffected | ||
7.3-rc1≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-80950
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
i3c: renesas: Check that the transfer is valid before accessing it
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
i3c: renesas: Check that the transfer is valid before accessing it
The Renesas I3C driver uses an asynchronous model to transfer data. It
prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion.
The interrupt handler dequeues the transfer, updates/uses it, and signals
the waiting thread.
If the completion times out, the waiting thread dequeues the transfer and
free it. If an interrupt fires after that, the handler may access freed
memory, leading to crashes.
Check that the transfer is still valid before accessing it in the
interrupt handler. With it clear any status flags and disable all
the interrupts to avoid triggering the same interrupts again.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-80950
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-80950
请登录查看更多情报信息。
Other References for CVE-2026-80950 (3)
Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total
| CVE-2026-89490 | ocfs2: fix readdir position truncation on 32-bit kernels | |
| CVE-2026-89478 | sctp: drop a chunk if its transport was removed | |
| CVE-2026-89479 | sctp: stop processing a packet once its association is deleted | |
| CVE-2026-89480 | nvme-tcp: reject a read that transferred too few bytes | |
| CVE-2026-89482 | nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone | |
| CVE-2026-89481 | nvme-tcp: fix host memory disclosure on R2T for a read command | |
| CVE-2026-89483 | nvme: zero the discard fallback page | |
| CVE-2026-89484 | lockd: fix NULL dereference on lockowner allocation failure | |
| CVE-2026-89485 | lockd: pin next file across nlm_inspect_file lock-drop | |
| CVE-2026-89486 | ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() | |
| CVE-2026-89487 | openvswitch: only skb_tx_error() a packet we are about to drop | |
| CVE-2026-89488 | openvswitch: Fix CT limit teardown use-after-free | |
| CVE-2026-89489 | openrisc: fix arbitrary kernel memory access via or1k_atomic syscall | |
| CVE-2026-89491 | ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() | |
| CVE-2026-89501 | ring-buffer: Hold cpu_buffer::lock when resizing a subbuf | |
| CVE-2026-89498 | orangefs: fix double-free of trailer_buf on readdir copy failure | |
| CVE-2026-89499 | ring-buffer: Stop remote reader update when page swap fails | |
| CVE-2026-89500 | ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page | |
| CVE-2026-89497 | orangefs: skip leading spaces before parsing client debug masks | |
| CVE-2026-89502 | ring-buffer: Free cpu_buffer::free_page with subbuf_order |
Showing top 20 of 431 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-89773
drm/amd/display: Skip Update HDCP Config In Transition State -
CVE-2026-89772
btrfs: write-protect folios during data writeback -
CVE-2026-89771
ring-buffer: Fix subbuf resize race with ring buffer readers -
CVE-2026-89770
iomap: don't free integrity payload that doesn't exist -
CVE-2026-89769
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_sta
Same vendor: Linux
-
CVE-2026-89773
drm/amd/display: Skip Update HDCP Config In Transition State -
CVE-2026-89772
btrfs: write-protect folios during data writeback -
CVE-2026-89771
ring-buffer: Fix subbuf resize race with ring buffer readers -
CVE-2026-89770
iomap: don't free integrity payload that doesn't exist -
CVE-2026-89769
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_sta
V. Comments for CVE-2026-80950
No comments yet