PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45863 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's DesignWare I3C master driver. The dw_i3c_master_i2c_xfers() function allocates memory for an xfer structure using dw_i3c_master_alloc_xfer(), but if pm_runtime_resume_and_get() fails, the function returns without freeing the allocated memory. This results in a memory leak on the error path. The fix adds a dw_i3c_master_free_xfer() call to properly release the allocated memory when the runtime power management operation fails. The vulnerability was identified through prototype static analysis tooling and code review, with the fix being compile-tested only.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Linux kernel maintainers, embedded systems developers using I3C/DesignWare controllers, and organizations running Linux on hardware with I3C bus support should prioritize this fix to prevent memory exhaustion in long-running systems.

Technical summary

The DesignWare I3C master driver in the Linux kernel contains a memory leak in dw_i3c_master_i2c_xfers(). Memory allocated via dw_i3c_master_alloc_xfer() is not freed if pm_runtime_resume_and_get() returns an error, causing resource exhaustion on repeated error conditions. The fix adds proper cleanup via dw_i3c_master_free_xfer() on the error path.

Defensive priority

medium

Recommended defensive actions

  • Review Linux kernel I3C DesignWare driver configurations in your environment
  • Apply kernel updates when available from your distribution
  • Monitor for stable kernel releases containing the referenced commits
  • Consider runtime memory leak detection tools for kernel driver validation

Evidence notes

The vulnerability description indicates this was found using a prototype static analysis tool and code review, with compile testing only performed on the fix. The issue affects the DesignWare I3C master driver in the Linux kernel. Multiple stable kernel branch fixes are referenced in the source data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45863 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45863

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45863 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45863

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/140a45bd4f6db7d1b30cab967d29689b946c52fa

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2537089413514caaa9a5fdeeac3a34d45100f747

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8e71414e252c1cb235911008a98fd47927d3a55c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a2c41467ef42f69a3958493a0395ba75174710dc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.