CVE-2026-72454

A flaw was found in the Linux kernel's MIPI I3C Host Controller Interface (HCI) driver. A race condition in the i3c_hci_addr_to_dev() function allows concurrent device addition or removal operations to modify a device list while it is being traversed without proper locking. This can lead to a use-after-free vulnerability, potentially enabling a local attacker to execute arbitrary code or cause a denial of service (DoS).

A moderate use-after-free vulnerability was found in the Linux kernel's MIPI I3C Host Controller Interface (HCI) driver. The i3c_hci_addr_to_dev() function, which is invoked from the MIPI I3C HCI interrupt handler, walks the I3C bus device list without holding the bus lock, because that lock cannot be taken in interrupt context. Concurrent device addition or removal in the I3C core can therefore modify the list while it is being traversed, which can lead to a use-after-free or a kernel crash. Exploiting this flaw requires local access to a system with affected MIPI I3C HCI hardware and privileged interaction with the I3C subsystem; the most likely consequence is a denial of service, although use-after-free memory corruption could in the worst case enable arbitrary code execution in the kernel. Red Hat rated this flaw Moderate severity with a CVSS3 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting that the flaw is local-only and primarily affects availability; this is lower than the upstream CVE.org rating of Important (7.8), which assumes full confidentiality and integrity impact. Red Hat Enterprise Linux 6, 7, 8, and 9 are not affected because the vulnerable code is not present in their kernel packages. The kernel components of Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected; a fix has been deferred for these streams because the flaw requires privileged local access to hardware-specific I3C code paths and is difficult to trigger reliably, leaving a residual risk of a local denial of service, or in the worst case kernel code execution, on systems with MIPI I3C HCI hardware undergoing I3C device addition or removal.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.