---
id: CVE-2026-80950
title: >-
  kernel: i3c: renesas: Check that the transfer is valid before accessing it
  (CVE-2026-80950)
summary: >-
  A flaw was found in the Linux kernel's Renesas I3C driver. This driver uses an
  asynchronous model for data transfers. When a transfer times out, the
  associated memory is freed. However, if an interrupt occurs after the memory
  is freed but …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-825
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
affected:
  - openshift_container_platform 4
published: '2026-09-11'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T16:46:37+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80950.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80950.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80950'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532234'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80950'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80950'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80950.mbox
  - url: 'https://git.kernel.org/stable/c/0093f9fc102ba8b98561fdd2f8559553ef56be59'
  - url: 'https://git.kernel.org/stable/c/5f1a76ecfe90544a28d657306c9b3caa66ba0e63'
  - url: 'https://git.kernel.org/stable/c/ec631aff93261c6d031f953549802322032f2aba'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00161
epssPercentile: 0.0577
scores:
  vendor: 4.7
  cna: 7.8
ingestedAt: '2026-09-14T15:23:07.476Z'
---

## Overview

A flaw was found in the Linux kernel's Renesas I3C driver. This driver uses an asynchronous model for data transfers. When a transfer times out, the associated memory is freed. However, if an interrupt occurs after the memory is freed but before the interrupt handler is aware, it can attempt to access the freed memory, leading to a use-after-free vulnerability. This can result in a system crash, causing a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80950.json)

**kernel: i3c: renesas: Check that the transfer is valid before accessing it** — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-14.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.