---
id: CVE-2026-43353
title: 'i3c: mipi-i3c-hci: Fix race in DMA ring dequeue'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  i3c: mipi-i3c-hci: Fix race in DMA ring dequeue

  The HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for
  multiple transfers that timeout around the same ti…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 <
    73bb6b15f1fd71479ed12b314876f3ce5935b80a
  - >-
    Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 <
    16061383a9def977e4be908c7dcede9a8a4227fd
  - >-
    Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 <
    b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e
  - >-
    Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 <
    4faa1e9c67a2229f6749190aedaf88ce0391efd2
  - >-
    Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 <
    1dca8aee80eea76d2aae21265de5dd64f6ba0f09
  - Linux 5.11
published: '2026-05-08'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:40:43.803Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43353'
references:
  - url: 'https://git.kernel.org/stable/c/73bb6b15f1fd71479ed12b314876f3ce5935b80a'
  - url: 'https://git.kernel.org/stable/c/16061383a9def977e4be908c7dcede9a8a4227fd'
  - url: 'https://git.kernel.org/stable/c/b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e'
  - url: 'https://git.kernel.org/stable/c/4faa1e9c67a2229f6749190aedaf88ce0391efd2'
  - url: 'https://git.kernel.org/stable/c/1dca8aee80eea76d2aae21265de5dd64f6ba0f09'
tags:
  - cve.org
epss: 0.00134
epssPercentile: 0.02596
ingestedAt: '2026-10-21T12:48:53.641Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

i3c: mipi-i3c-hci: Fix race in DMA ring dequeue

The HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for
multiple transfers that timeout around the same time.  However, the
function is not serialized and can race with itself.

When a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes
incomplete transfers, and then restarts the ring.  If another timeout
triggers a parallel call into the same function, the two instances may
interfere with each other - stopping or restarting the ring at unexpected
times.

Add a mutex so that hci_dma_dequeue_xfer() is serialized with respect to
itself.

## Affected

- `Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 73bb6b15f1fd71479ed12b314876f3ce5935b80a`
- `Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 16061383a9def977e4be908c7dcede9a8a4227fd`
- `Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e`
- `Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 4faa1e9c67a2229f6749190aedaf88ce0391efd2`
- `Linux >= 9ad9a52cce2828d932ae9495181e3d6414f72c07 < 1dca8aee80eea76d2aae21265de5dd64f6ba0f09`
- `Linux 5.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.