CVE-2026-14367

Name of the Vulnerable Software and Affected Versions (affected versions not specified)

Description A race condition exists in the I3C IBI subsystem within drivers/i3c/i3c ibi workq.c due to a lack of synchronization in the i3c ibi work nodes free free-list. The allocation helpers i3c ibi work enqueue(), i3c ibi work enqueue target irq(), i3c ibi work enqueue hotjoin(), i3c ibi work enqueue controller request(), and i3c ibi work enqueue cb() call sys slist get() from an Interrupt Service Routine (ISR) context, while the i3c ibi work handler() function returns nodes using sys slist append() from a workqueue thread. Since these operations are not atomic or interrupt-safe, concurrent access can corrupt the list linkage, leading to nodes being assigned to multiple consumers, lost nodes, or the return of invalid pointers. This can result in memory corruption via memcpy() or out-of-bounds writes. An attacker with physical access to the I3C bus could trigger this by generating high-frequency interrupts, potentially causing a system crash or hang.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.