CVE-2023-52766

What it actually does

Out-of-bounds memory access in hci_dma_irq_handler() when iterating over ring headers beyond those allocated and enabled during hci_dma_init(), enabling kernel memory corruption.

Why it matters to the business

Linux systems using affected I3C HCI hardware may experience kernel instability, crashes, or potential privilege escalation with low likelihood of remote exploitation; the issue affects stable kernel trees but carries minimal observed risk given low EPSS and no KEV listing.

How an attack unfolds

An attacker with local access or the ability to influence DMA ring initialization and IRQ triggering can cause the handler to dereference unallocated ring header structures, leading to out-of-bounds reads or writes; no active campaigns by listed threat actors have been confirmed against this specific flaw.

How to fix it

Apply the upstream fix commit d23ad76f240c0f597b7a9eb79905d246f27d40df or later; rebuild and deploy updated Linux kernel packages containing this change to all affected systems.

How to confirm the fix worked

Verify the presence of the fix by inspecting the hci_dma_irq_handler() function in the kernel source for bounds checking against allocated ring headers, or confirm kernel version/build includes d23ad76f240c0f597b7a9eb79905d246f27d40df.

Typical attack path

1. Obtain local execution or hardware control on an affected Linux kernel
2. Manipulate I3C DMA ring allocation to create a mismatch between allocated headers and IRQ handler loop bounds
3. Trigger hci_dma_irq_handler() via hardware interrupt
4. Access rings->headers[i] for i beyond allocated count resulting in memory corruption

How to detect it

Search kernel logs and crash dumps for oops or warnings originating from hci_dma_irq_handler or i3c DMA ring access; examine for evidence of out-of-bounds accesses in mipi-i3c-hci code paths.

• hci_dma_irq_handler
• rings->headers[i]
• hci_dma_init

What your security team should do

• Prioritize kernel updates on systems exposing the mipi-i3c-hci driver
• Monitor for kernel oops/panic reports referencing i3c or DMA rings
• Apply the fix within standard patch cycles given low EPSS and absence from KEV