Security readout for executives and security teams
Plain-English summary
A race condition in Linux’s MIPI I3C HCI DMA driver can occur when multiple transfers time out together. Competing cleanup operations may stop or restart the DMA ring unexpectedly. The supplied CVSS assessment indicates potentially serious confidentiality, integrity, and availability impact, but only with local, low-privileged access and relevant hardware or driver exposure.
Executive priority
Treat this as high priority for systems using affected I3C HCI hardware, especially shared or locally accessible hosts. First confirm driver exposure because the issue is hardware-path-specific and requires local access. Schedule a supported kernel update promptly where exposed; broader emergency action is not justified by the supplied exploitation evidence.
Technical view
The hci_dma_dequeue_xfer() timeout path was not serialized. Concurrent calls could interfere while stopping the DMA ring, processing incomplete transfers, and restarting it. The kernel fix adds a mutex to serialize this function against itself. The supplied data rates it CVSS 3.1 7.8: local, low complexity, low privileges, no user interaction.
Likely exposure
Exposure appears limited to Linux systems using the mipi-i3c-hci driver and its DMA transfer path. The supplied affected-version data is ambiguous and includes unusual entries, so it should not be treated as a clean version range. Systems without this hardware or loaded driver are unlikely to reach the vulnerable path.
Exploitation context
The CVSS vector describes a local, low-privileged attack with potentially high impact. No supplied source establishes public exploitation, exploit availability, or inclusion in CISA KEV; KEV is explicitly false. The evidence does not explain how reliably an unprivileged user can induce the required concurrent transfer timeouts.
Researcher notes
The core defect is re-entrancy in timeout recovery, not a general DMA-ring flaw. Concurrent dequeue handlers can produce inconsistent stop/restart sequencing. The sources claim high confidentiality, integrity, and availability consequences but do not document a demonstrated corruption primitive, trigger reliability, crash signature, affected-range boundaries, or successful exploitation. Version conclusions therefore require commit-level or distributor-level verification.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced serialization fix.
- Match distribution kernel builds against vendor advisories and the three referenced stable commits.
- Prioritize systems where the mipi-i3c-hci driver and relevant I3C hardware are present.
- Where updating is delayed, consult the Linux distributor for supported mitigations or backports.
Validation and detection
- Inventory kernel versions and determine whether mipi-i3c-hci is present or loaded.
- Check vendor changelogs for CVE-2026-43353 or the referenced stable commits.
- Confirm the installed kernel package includes the mutex-based dequeue serialization fix.
- After updating, verify the intended kernel is running and monitor for I3C DMA timeout errors.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43353 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b684b420a5bb0ea1b0e13abfdb8ce41c5266e62eCVE reference, Linux
- https://git.kernel.org/stable/c/4faa1e9c67a2229f6749190aedaf88ce0391efd2CVE reference, Linux
- https://git.kernel.org/stable/c/1dca8aee80eea76d2aae21265de5dd64f6ba0f09CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.