{"id":"CVE-2026-43353","title":"i3c: mipi-i3c-hci: Fix race in DMA ring dequeue","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Fix race in DMA ring dequeue\n\nThe HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for\nmultiple transfers that timeout around the same ti…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 73bb6b15f1fd71479ed12b314876f3ce5935b80a","Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 16061383a9def977e4be908c7dcede9a8a4227fd","Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e","Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 4faa1e9c67a2229f6749190aedaf88ce0391efd2","Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 1dca8aee80eea76d2aae21265de5dd64f6ba0f09","Linux 5.11"],"published":"2026-05-08","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:40:43.803Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43353","references":[{"url":"https://git.kernel.org/stable/c/73bb6b15f1fd71479ed12b314876f3ce5935b80a"},{"url":"https://git.kernel.org/stable/c/16061383a9def977e4be908c7dcede9a8a4227fd"},{"url":"https://git.kernel.org/stable/c/b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e"},{"url":"https://git.kernel.org/stable/c/4faa1e9c67a2229f6749190aedaf88ce0391efd2"},{"url":"https://git.kernel.org/stable/c/1dca8aee80eea76d2aae21265de5dd64f6ba0f09"}],"tags":["cve.org"],"epss":0.00134,"epssPercentile":0.02596,"ingestedAt":"2026-10-21T12:48:53.641Z","slug":"CVE-2026-43353","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Fix race in DMA ring dequeue\n\nThe HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for\nmultiple transfers that timeout around the same time.  However, the\nfunction is not serialized and can race with itself.\n\nWhen a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes\nincomplete transfers, and then restarts the ring.  If another timeout\ntriggers a parallel call into the same function, the two instances may\ninterfere with each other - stopping or restarting the ring at unexpected\ntimes.\n\nAdd a mutex so that hci_dma_dequeue_xfer() is serialized with respect to\nitself.\n\n## Affected\n\n- `Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 73bb6b15f1fd71479ed12b314876f3ce5935b80a`\n- `Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 16061383a9def977e4be908c7dcede9a8a4227fd`\n- `Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e`\n- `Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 4faa1e9c67a2229f6749190aedaf88ce0391efd2`\n- `Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 1dca8aee80eea76d2aae21265de5dd64f6ba0f09`\n- `Linux 5.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}