CVE-2026-43352

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43352", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.004Z", "datePublished": "2026-05-08T14:21:09.552Z", "dateUpdated": "2026-10-30T12:25:28.372Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:25:28.372Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue\n\nThe logic used to abort the DMA ring contains several flaws:\n\n 1. The driver unconditionally issues a ring abort even when the ring has\n already stopped.\n 2. The completion used to wait for abort completion is never\n re-initialized, resulting in incorrect wait behavior.\n 3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which\n resets hardware ring pointers and disrupts the controller state.\n 4. If the ring is already stopped, the abort operation should be\n considered successful without attempting further action.\n\nFix the abort handling by checking whether the ring is running before\nissuing an abort, re-initializing the completion when needed, ensuring that\nRING_CTRL_ENABLE remains asserted during abort, and treating an already\nstopped ring as a successful condition."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable DMA dequeue path is reached through local I3C/I2C transfer paths on a system with MIPI I3C HCI hardware, including kernel I3C client drivers and the i2c-dev ioctl path. It is not reachable through network packets or a remotely exposed protocol.\nAC:L - A local attacker who can initiate transfers can force timeout/error handling, for example by setting aggressive I2C adapter timeouts and issuing transfers, causing the dequeue abort path to run. The trigger does not depend on an uncontrollable race or rare memory layout.\nPR:L - The practical attacker needs local access to an exposed I2C/I3C transfer interface or low-privilege access to driver operations that initiate I3C transfers. No init-namespace root-only capability gate or user-namespace-mediated privilege path is required for the core vulnerable path.\nUI:N - Once the attacker has local access to the relevant transfer interface, exploitation does not require another user to perform an action. The attacker can repeatedly issue the triggering transfers themselves.\nS:U - The vulnerability corrupts or disrupts kernel/controller state within the same host security authority. It does not constitute a VM escape or a demonstrated IOMMU/security-scope bypass.\nC:H - The faulty abort handling can fail to stop DMA correctly and can unmap/free transfer buffers while hardware may still be writing, creating a plausible kernel memory corruption primitive. Under the required higher-severity rule, this is scored as potentially enabling high-impact information disclosure.\nI:H - Incorrectly aborting and restarting the DMA ring can leave hardware DMA active against stale or reused memory and corrupt kernel data structures. Such DMA-after-unmap memory corruption is defensibly treated as high integrity impact because it may be shaped into arbitrary kernel memory modification or control-flow compromise.\nA:H - The bug can disrupt the controller state, trigger WARN_ON paths, hang transfers, and plausibly corrupt kernel memory through continued DMA after a failed abort. This supports high availability impact due to kernel crash, hang, or persistent device failure."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i3c/master/mipi-i3c-hci/dma.c"], "versions": [{"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "lessThan": "377e75da122ffce7cec551f43fa884d57f2f8e63", "status": "affected", "versionType": "git"}, {"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "lessThan": "04b2853fdbb2ec9d03ece45da3c830396647120f", "status": "affected", "versionType": "git"}, {"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "lessThan": "55a0b47a372245f7667e0a4ba5c6f2a4c7a889a6", "status": "affected", "versionType": "git"}, {"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "lessThan": "003df94bcc9227e8e930abd03ac7f63ac10033dc", "status": "affected", "versionType": "git"}, {"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "lessThan": "5549611888f5ca2db5e8e692b57f30626ddf9898", "status": "affected", "versionType": "git"}, {"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "lessThan": "b795e68bf3073d67bebbb5a44d93f49efc5b8cc7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i3c/master/mipi-i3c-hci/dma.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.19.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/377e75da122ffce7cec551f43fa884d57f2f8e63"}, {"url": "https://git.kernel.org/stable/c/04b2853fdbb2ec9d03ece45da3c830396647120f"}, {"url": "https://git.kernel.org/stable/c/55a0b47a372245f7667e0a4ba5c6f2a4c7a889a6"}, {"url": "https://git.kernel.org/stable/c/003df94bcc9227e8e930abd03ac7f63ac10033dc"}, {"url": "https://git.kernel.org/stable/c/5549611888f5ca2db5e8e692b57f30626ddf9898"}, {"url": "https://git.kernel.org/stable/c/b795e68bf3073d67bebbb5a44d93f49efc5b8cc7"}], "title": "i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/i3c/master/mipi-i3c-hci/dma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "377e75da122ffce7cec551f43fa884d57f2f8e63", "status": "affected", "version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "versionType": "git"}, {"lessThan": "04b2853fdbb2ec9d03ece45da3c830396647120f", "status": "affected", "version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "versionType": "git"}, {"lessThan": "55a0b47a372245f7667e0a4ba5c6f2a4c7a889a6", "status": "affected", "version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "versionType": "git"}, {"lessThan": "003df94bcc9227e8e930abd03ac7f63ac10033dc", "status": "affected", "version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "versionType": "git"}, {"lessThan": "5549611888f5ca2db5e8e692b57f30626ddf9898", "status": "affected", "version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "versionType": "git"}, {"lessThan": "b795e68bf3073d67bebbb5a44d93f49efc5b8cc7", "status": "affected", "version": "9ad9a52cce2828d932ae9495181e3d6414f72c07", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/i3c/master/mipi-i3c-hci/dma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.19", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2303E895-6E04-4172-831C-1F2500169926", "versionEndExcluding": "6.18.19", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue\n\nThe logic used to abort the DMA ring contains several flaws:\n\n 1. The driver unconditionally issues a ring abort even when the ring has\n already stopped.\n 2. The completion used to wait for abort completion is never\n re-initialized, resulting in incorrect wait behavior.\n 3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which\n resets hardware ring pointers and disrupts the controller state.\n 4. If the ring is already stopped, the abort operation should be\n considered successful without attempting further action.\n\nFix the abort handling by checking whether the ring is running before\nissuing an abort, re-initializing the completion when needed, ensuring that\nRING_CTRL_ENABLE remains asserted during abort, and treating an already\nstopped ring as a successful condition."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ni3c: mipi-i3c-hci: Manejo correcto de RING_CTRL_ABORT en la desencolaci\u00f3n DMA\n\nLa l\u00f3gica utilizada para abortar el anillo DMA contiene varios fallos:\n\n1. El controlador emite incondicionalmente un aborto de anillo incluso cuando el anillo ya se ha detenido.\n2. La finalizaci\u00f3n utilizada para esperar la finalizaci\u00f3n del aborto nunca se reinicializa, lo que resulta en un comportamiento de espera incorrecto.\n3. La secuencia de aborto borra involuntariamente RING_CTRL_ENABLE, lo que reinicia los punteros del anillo de hardware y altera el estado del controlador.\n4. Si el anillo ya est\u00e1 detenido, la operaci\u00f3n de aborto debe considerarse exitosa sin intentar ninguna acci\u00f3n adicional.\n\nCorregir el manejo del aborto verificando si el anillo est\u00e1 en ejecuci\u00f3n antes de emitir un aborto, reinicializando la finalizaci\u00f3n cuando sea necesario, asegurando que RING_CTRL_ENABLE permanezca afirmado durante el aborto, y tratando un anillo ya detenido como una condici\u00f3n exitosa."}], "id": "CVE-2026-43352", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-08T15:16:45.937", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/003df94bcc9227e8e930abd03ac7f63ac10033dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/04b2853fdbb2ec9d03ece45da3c830396647120f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/377e75da122ffce7cec551f43fa884d57f2f8e63"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5549611888f5ca2db5e8e692b57f30626ddf9898"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/55a0b47a372245f7667e0a4ba5c6f2a4c7a889a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b795e68bf3073d67bebbb5a44d93f49efc5b8cc7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue", "id": "2468177", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468177"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-372", "details": ["A flaw was found in the Linux kernel's I3C (Improved Inter-Integrated Circuit) Host Controller Interface (HCI) driver. Incorrect handling of DMA (Direct Memory Access) ring aborts can lead to the unintentional clearing of `RING_CTRL_ENABLE`. This action resets hardware ring pointers and disrupts the controller's state, potentially causing system instability or a denial of service."], "name": "CVE-2026-43352", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43352\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43352\nhttps://lore.kernel.org/linux-cve-announce/2026050823-CVE-2026-43352-73ed@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9ad9a52cce2828d932ae9495181e3d6414f72c07,003df94bcc9227e8e930abd03ac7f63ac10033dc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9ad9a52cce2828d932ae9495181e3d6414f72c07,5549611888f5ca2db5e8e692b57f30626ddf9898)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9ad9a52cce2828d932ae9495181e3d6414f72c07,b795e68bf3073d67bebbb5a44d93f49efc5b8cc7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.19,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T17:00:14.842325+00:00", "updated": "2026-05-15T21:30:08.892847+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}