CVE-2026-43352

What it actually does

This is a local Linux kernel vulnerability in the MIPI I3C HCI driver’s DMA ring abort path. Incorrect handling of RING_CTRL_ABORT can cause the driver to abort an already stopped DMA ring, wait on a stale completion object, clear RING_CTRL_ENABLE unexpectedly, and reset hardware ring pointers. On systems with the affected I3C HCI driver and hardware path in use, a local user able to exercise the relevant I3C controller operations may be able to corrupt kernel/controller state, trigger a kernel crash, or potentially escalate privileges through memory corruption or inconsistent DMA state.

Why it matters to the business

Successful exploitation can compromise the stability and security of Linux systems that expose the affected I3C HCI driver path, potentially causing outages, device instability, or unauthorized administrative control. The issue requires local access and is not known to be exploited in the wild, and its EPSS score is low, but the CVSS impact is high because kernel-level exploitation can affect confidentiality, integrity, and availability. Risk is highest for embedded, mobile, server, or specialized hardware platforms using MIPI I3C HCI support.

How an attack unfolds

An attacker first obtains local, low-privileged access to a Linux system where the affected MIPI I3C HCI kernel driver is present and the relevant I3C controller interface can be exercised. The attacker then triggers controller activity that causes the driver to dequeue or abort a DMA ring. Because the vulnerable abort logic mishandles stopped rings, stale completions, and the RING_CTRL_ENABLE bit, repeated or carefully timed operations may put the controller and kernel driver into an inconsistent state. Depending on the kernel build, hardware behavior, and reachable interfaces, this may result in a denial of service through a kernel panic or, in a stronger exploitation scenario, corruption of kernel-controlled state that could be shaped into local privilege escalation.

How to fix it

Upgrade to a Linux kernel build that includes the upstream fix for the MIPI I3C HCI DMA ring abort handling. If a distribution kernel is used, apply the vendor security update rather than only relying on upstream version numbers. Where immediate patching is not possible, reduce exposure by disabling or unloading the MIPI I3C HCI driver if it is not required, disabling unused I3C hardware in firmware where supported, and restricting local shell access to trusted users. Because no fixed versions were provided in the input, validate remediation against the distribution advisory or kernel commit that corrects RING_CTRL_ABORT handling in drivers/i3c/master/mipi-i3c-hci.

How to confirm the fix worked

Confirm the running kernel package or custom kernel source includes the fix that checks whether the ring is running before aborting, reinitializes the abort completion, preserves RING_CTRL_ENABLE during abort, and treats an already stopped ring as successful. Check whether the affected driver is built or loaded using kernel configuration and module inspection, such as CONFIG_MIPI_I3C_HCI and loaded module listings. Validate that vendor advisories mark the installed kernel as fixed. After patching, monitor kernel logs while exercising normal I3C functionality and confirm there are no recurring DMA ring abort errors, kernel warnings, Oops events, or controller resets associated with the MIPI I3C HCI driver.

Typical attack path

1. Gain local access to a Linux system as an unprivileged or low-privileged user.
2. Confirm the system has the affected MIPI I3C HCI driver available, loaded, or reachable through hardware-specific interfaces.
3. Trigger I3C controller activity that reaches the DMA dequeue and ring abort path.
4. Repeatedly exercise timing-sensitive abort or stop conditions to induce inconsistent ring state.
5. Use the resulting kernel/controller state corruption to crash the system or attempt privilege escalation.

How to detect it

Look for evidence of local exploitation attempts in kernel and system logs rather than network telemetry, because this is a local kernel-driver issue. Review dmesg, journald, /var/log/kern.log, /var/log/messages, crash dumps, kdump/vmcore artifacts, audit logs, and EDR process telemetry around unexplained reboots or kernel crashes. Focus on kernel warnings, Oops traces, panics, DMA errors, controller resets, or repeated access to I3C-related device interfaces immediately before instability. Also review module load history for the MIPI I3C HCI driver and local user activity that repeatedly interacts with hardware-management, test, fuzzing, or device-control tools. There are no public exploit-specific indicators in the provided data, so detection should combine driver-specific kernel artifacts with local process and user activity timelines.

• mipi-i3c-hci
• mipi_i3c_hci
• drivers/i3c/master/mipi-i3c-hci
• RING_CTRL_ABORT
• RING_CTRL_ENABLE
• i3c: mipi-i3c-hci
• DMA ring abort
• ring abort
• kernel BUG
• kernel panic
• Oops:
• general protection fault
• WARNING: CPU:
• Call Trace:
• /var/log/kern.log
• /var/log/messages
• /proc/config.gz
• CONFIG_MIPI_I3C_HCI

What your security team should do

• Prioritize patching systems that use I3C-capable hardware, embedded Linux builds, or custom kernels with the MIPI I3C HCI driver enabled.
• Inventory Linux kernels with MIPI I3C HCI support compiled in or available as a module, especially on hardware platforms where I3C controllers are exposed.
• If patching is delayed, disable or block loading of the affected driver where operationally feasible.
• Restrict local access on affected systems because exploitation requires local privileges.
• Review kernel logs for historical crashes, Oops traces, DMA ring errors, or unexplained reboots involving the I3C HCI driver.
• Track Linux distribution advisories for the exact fixed kernel package version applicable to each platform.