{"id":"CVE-2026-80950","title":"kernel: i3c: renesas: Check that the transfer is valid before accessing it (CVE-2026-80950)","summary":"A flaw was found in the Linux kernel's Renesas I3C driver. This driver uses an asynchronous model for data transfers. When a transfer times out, the associated memory is freed. However, if an interrupt occurs after the memory is freed but …","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-825","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","affected":["openshift_container_platform 4"],"published":"2026-09-11","updated":"2026-09-14","sourceUpdated":"2026-09-14T16:46:37+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80950.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80950.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-80950"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532234"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80950"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80950"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80950.mbox"},{"url":"https://git.kernel.org/stable/c/0093f9fc102ba8b98561fdd2f8559553ef56be59"},{"url":"https://git.kernel.org/stable/c/5f1a76ecfe90544a28d657306c9b3caa66ba0e63"},{"url":"https://git.kernel.org/stable/c/ec631aff93261c6d031f953549802322032f2aba"}],"tags":["csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.00161,"epssPercentile":0.05763,"scores":{"vendor":4.7,"cna":7.8},"ingestedAt":"2026-09-14T15:23:07.476Z","slug":"CVE-2026-80950","body":"## Overview\n\nA flaw was found in the Linux kernel's Renesas I3C driver. This driver uses an asynchronous model for data transfers. When a transfer times out, the associated memory is freed. However, if an interrupt occurs after the memory is freed but before the interrupt handler is aware, it can attempt to access the freed memory, leading to a use-after-free vulnerability. This can result in a system crash, causing a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80950.json)\n\n**kernel: i3c: renesas: Check that the transfer is valid before accessing it** — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-14.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":204253,"id":"CVE-2026-80950","ts":1789490240648,"field":"cvss","old":"4.7","new":"5.5"},{"seq":202947,"id":"CVE-2026-80950","ts":1789403733065,"field":"cvss","old":"7.8","new":"4.7"},{"seq":202946,"id":"CVE-2026-80950","ts":1789403733065,"field":"severity","old":"high","new":"medium"},{"seq":183622,"id":"CVE-2026-80950","ts":1789356676142,"field":"cvss","old":"7.8","new":"4.7"},{"seq":183621,"id":"CVE-2026-80950","ts":1789356676142,"field":"severity","old":"high","new":"medium"},{"seq":153132,"id":"CVE-2026-80950","ts":1789285349167,"field":"cvss","old":null,"new":"7.8"},{"seq":153131,"id":"CVE-2026-80950","ts":1789285349167,"field":"severity","old":"none","new":"high"},{"seq":147520,"id":"CVE-2026-80950","ts":1789270211229,"field":"cvss","old":null,"new":"4.7"},{"seq":147519,"id":"CVE-2026-80950","ts":1789270211229,"field":"severity","old":"none","new":"medium"},{"seq":109274,"id":"CVE-2026-80950","ts":1789183731236,"field":"cvss","old":null,"new":"4.7"},{"seq":109273,"id":"CVE-2026-80950","ts":1789183731236,"field":"severity","old":"none","new":"medium"}]}