LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43352: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue

In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue The logic used to abort the DMA ring contains several flaws: 1. The driver unconditionally issues a ring abort even when the ring has already stopped. 2. The completion used to wait for abort completion is never re-initialized, resulting in incorrect wait behavior. 3. The abort sequence unintentionally clears RING_CTRL_ENABLE, which resets hardware ring pointers and disrupts the controller state. 4. If the ring is already stopped, the abort operation should be considered successful without attempting further action. Fix the abort handling by checking whether the ring is running before issuing an abort, re-initializing the completion when needed, ensuring that RING_CTRL_ENABLE remains asserted during abort, and treating an already stopped ring as a successful condition.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux I3C controller driver mishandles DMA ring aborts. Under affected conditions, it can wait incorrectly, reset hardware ring pointers, and disrupt controller state. The supplied CVSS rates potential confidentiality, integrity, and availability impact as high, but the source bundle does not document a demonstrated attack scenario.

Executive priority

Prioritize affected systems where I3C hardware is present and untrusted users or workloads can execute locally. Treat remediation as high priority, but avoid an estate-wide emergency response until hardware and driver exposure is confirmed. There is no supplied evidence of active exploitation.

Technical view

The mipi-i3c-hci DMA dequeue path may abort an already-stopped ring, reuse a completion without reinitialization, and clear RING_CTRL_ENABLE during abort. The cited fixes check ring state, reinitialize completion, preserve ring enablement, and treat an already-stopped ring as success. CVSS 3.1 is 7.8, requiring local access and low privileges.

Likely exposure

Exposure is limited to Linux systems using the affected MIPI I3C HCI driver and relevant hardware path. The supplied affected-version data names releases and commits but lacks clear range semantics, so organizations should verify distribution-specific kernel advisories and backports rather than relying only on version strings.

Exploitation context

The supplied record is not listed in KEV and provides no evidence of active exploitation or a public exploit. The CVSS vector indicates a local, low-privilege attack context with no user interaction. The bundle does not explain how an attacker would reliably trigger the flawed DMA abort state or achieve the rated impacts.

Researcher notes

The defect combines state validation, completion lifecycle, and control-register preservation errors. The fix behavior is described clearly, but triggerability, affected hardware implementations, exploit reliability, and precise version boundaries are not established in the bundle. The repeated commit and version data should be checked against upstream and distribution advisories.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable cited stable fix or backport.
  • Check Linux distribution advisories for precise affected and corrected package versions.
  • Limit local account access and unnecessary low-privilege code execution until remediation.
  • Disable affected I3C functionality only if vendor guidance confirms a safe operational workaround.

Validation and detection

  • Inventory kernel versions and systems using MIPI I3C HCI hardware or drivers.
  • Confirm whether kernel source or vendor packages include an applicable cited fix commit.
  • Review kernel logs for I3C DMA abort failures, timeouts, or controller-state disruption.
  • Test I3C controller operations after updating, including DMA dequeue and recovery behavior.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43352 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-43352Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9ad9a52cce2828d932ae9495181e3d6414f72c07, 9ad9a52cce2828d932ae9495181e3d6414f72c07, 9ad9a52cce2828d932ae9495181e3d6414f72c07unaffected
LinuxLinux5.11, 0, 6.18.19, 6.19.9, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.