CVE-2026-43353High· 7.8▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue The HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for multiple transfers that timeout around the same ti…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
The HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for multiple transfers that timeout around the same time. However, the function is not serialized and can race with itself.
When a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes incomplete transfers, and then restarts the ring. If another timeout triggers a parallel call into the same function, the two instances may interfere with each other - stopping or restarting the ring at unexpected times.
Add a mutex so that hci_dma_dequeue_xfer() is serialized with respect to itself.
Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 73bb6b15f1fd71479ed12b314876f3ce5935b80aLinux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 16061383a9def977e4be908c7dcede9a8a4227fdLinux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < b684b420a5bb0ea1b0e13abfdb8ce41c5266e62eLinux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 4faa1e9c67a2229f6749190aedaf88ce0391efd2Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 1dca8aee80eea76d2aae21265de5dd64f6ba0f09Linux 5.11Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98869Nonebpf: Infer zext_dst based on static register liveness analysis
CVE-2023-7356NoneBluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
CVE-2026-98766Noneusb: gadget: aspeed-vhub: cancel wake work on device removal
CVE-2026-98768Medium· 4.7usb: typec: anx7411 - stop the IRQ before destroying the workqueue
CVE-2026-98767Noneusb: dwc3: gadget: fix IRQ storm on invalid event buffer count
CVE-2026-98770Noneusb: gadget: midi2: Fix the jack descriptor array sizes