CVE-2026-72454 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems, especially those using MIPI I3C HCI in their products, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing system configurations, updating kernel versions, and monitoring for potential exploitation attempts. Additionally, organizations using Linux-based systems in critical infrastructure or sensitive data processing environments should prioritize patching and compensating controls to minimize potential impact. IT security teams should also review and update their vulnerability management processes to ensure timely detection and response to similar issues in the future. Linux distributions and vendors may also need to provide guidance and support for affected users, and users should follow vendor recommendations for patching and mitigation. The Linux community and kernel maintainers may need to review and update the MIPI I3C HCI implementation to prevent similar vulnerabilities in the future. Users of Linux-based IoT devices, automotive systems, and other embedded systems using MIPI I3C HCI should also take necessary precautions to ensure the security of their devices and data. Furthermore, security researchers and vulnerability reporters should continue to monitor and analyze the Linux kernel and MIPI I3C HCI implementation to identify potential vulnerabilities and improve the overall security posture of Linux-based systems. Finally, organizations should consider implementing additional security controls, such as intrusion detection and prevention systems, to detect and prevent potential exploitation attempts. The Linux kernel community and distribution vendors should also prioritize providing clear guidance and support for affected users and ensure that patches and updates are widely available and easily deployable. In addition, users should ensure that their systems are configured securely and that MIPI I3C HCI is properly implemented and monitored to minimize potential risks. By taking these steps, organizations and individuals can help mitigate the risks associated with this vulnerability and ensure

Technical summary

The i3c_hci_addr_to_dev() function in the Linux kernel's MIPI I3C HCI IRQ handler has a race condition vulnerability. The function walks the bus->devs.i3c list, which is protected by bus.lock (rwsem), but is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent device addition/removal in the I3C core to modify the list while it is being traversed, potentially leading to use-after-free or crashes.

Defensive priority

High

Recommended defensive actions

• Inventory and assess Linux kernel systems for potential exposure
• Apply vendor patches or updates to address the vulnerability
• Monitor system logs for potential exploitation attempts
• Implement compensating controls, such as intrusion detection and prevention systems
• Review system configurations to ensure MIPI I3C HCI is properly implemented and monitored
• Track and verify patch deployment for affected systems
• Continuously monitor for potential exploitation attempts and update mitigation strategies as needed

Evidence notes

The vulnerability was resolved by removing the dependency on the bus device list and introducing a dedicated lookup table. An ibi_devs[] array indexed by DAT entry was added, maintained under hci->lock. The array is updated when IBIs are enabled or disabled, so that it always reflects the set of devices allowed to generate IBIs.

Official resources