Cloudanix VulnDB

CVE-2026-89728

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Linux systems with specific hardware could let an attacker cause crashes or memory problems during normal device setup if no devices are connected to that hardware bus.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds memory access in the Renesas I3C controller driver when computing the newdevs bitmask during Dynamic Address Assignment on an empty bus, because the response descriptor length field reports the controller maximum (8) instead of zero.

Why it matters to the business

Systems using Renesas I3C hardware may experience kernel instability, crashes, or memory corruption under normal bus initialization conditions; low exploitation probability reduces immediate risk but still requires patching on affected hardware.

How an attack unfolds

An attacker with the ability to trigger or observe DAA on a Renesas I3C bus that has no devices attached can cause the driver to read or write beyond allocated structures when the NRSPQP-reported device count equals the controller maximum, leading to memory corruption.

How to fix it

Update the Linux kernel to a version that includes the corrected condition for the newdevs bitmask calculation in the Renesas I3C driver; apply vendor-supplied kernel packages as they become available.

How to confirm the fix worked

Confirm the running kernel contains the upstream fix that adjusts the length check before computing the newly discovered devices bitmask; review dmesg or kernel logs during I3C initialization on empty buses for absence of related oops or warnings.

Typical attack path

  1. Gain local access or control sufficient to initiate I3C bus enumeration on target hardware
  2. Ensure or force the I3C bus to contain zero devices before DAA begins
  3. Trigger DAA so the controller reports maximum device count through NRSPQP
  4. Driver computes out-of-bounds newdevs mask and performs invalid memory access

How to detect it

Search kernel logs and crash dumps for oops or warnings referencing the Renesas I3C driver and NRSPQP or newdevs mask during bus initialization; correlate with timestamps of I3C controller load on empty buses.

What your security team should do

  • Inventory systems containing Renesas I3C controllers and prioritize kernel updates on those devices
  • Monitor upstream kernel changelogs for the exact commit that resolves the NRSPQP length handling
  • Apply updates within normal patch windows given the low EPSS and absence from KEV

The record

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA (Dynamic Address Assignment), the controller reports the result via the NRSPQP (Normal Response Queue Port Register). The data length field of the response descriptor, which is accessible through the NRSPQP register, indicates the number of devices remaining after DAA. Consequently, when the bus is empty, this field contains the maximum number of devices supported by the controller (8 for the Renesas I3C controller). Adjust the condition that computes the newly discovered devices bitmask to prevent an out-of-bounds when the I3C bus is empty.

Affected packages

Ecosystem Package Introduced Fixed