i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
CVE-2026-43353 · published 8 May 2026
How serious is it
- Severity: high, CVSS score 7.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-43353?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 9ad9a52cce2828d932ae9495181e3d6414f72c07 to < 73bb6b15f1fd71479ed12b314876f3ce5935b80a, 9ad9a52cce2828d932ae9495181e3d6414f72c07 to < 16061383a9def977e4be908c7dcede9a8a4227fd, 9ad9a52cce2828d932ae9495181e3d6414f72c07 to < b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e, 9ad9a52cce2828d932ae9495181e3d6414f72c07 to < 4faa1e9c67a2229f6749190aedaf88ce0391efd2
- Linux Linux: 5.11
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
The HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for
multiple transfers that timeout around the same time. However, the
function is not serialized and can race with itself.
When a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes
incomplete transfers, and then restarts the ring. If another timeout
triggers a parallel call into the same function, the two instances may
interfere with each other - stopping or restarting the ring at unexpected
times.
Add a mutex so that hci_dma_dequeue_xfer() is serialized with respect to
itself.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/73bb6b15f1fd71479ed12b314876f3ce5935b80a
- git.kernel.org/stable/c/16061383a9def977e4be908c7dcede9a8a4227fd
- git.kernel.org/stable/c/b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e
- git.kernel.org/stable/c/4faa1e9c67a2229f6749190aedaf88ce0391efd2
- git.kernel.org/stable/c/1dca8aee80eea76d2aae21265de5dd64f6ba0f09
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON