CVE-2026-97515 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel and NPCM845 device configurations should assess exposure and prioritize verification of affected versions. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

Defenders should assess exposure and prioritize verification of affected Linux kernel versions and NPCM845 device configurations to prevent potential IRQ storms.

• Potential IRQ storm could lock up the CPU
• Verification of affected Linux kernel versions and NPCM845 device configurations is necessary

Technical summary

The Linux kernel vulnerability could cause an IRQ storm on NPCM845 devices due to a false SLVSTART interrupt. The issue arises when a target on the I3C bus gets stuck holding SDA low, causing the controller to report a false Master Request in-band interrupt event. To prevent this, the SLVSTART status bit should be cleared explicitly after emitting a STOP condition in the Master Request IBI handler when the SVC_I3C_QUIRK_FALSE_SLVSTART quirk is set. This breaks the feedback loop without affecting normal SLVSTART processing.

Defensive priority

Defenders should assess exposure and prioritize verification of affected Linux kernel versions and NPCM845 device configurations.

Recommended defensive actions

• Assess exposure of Linux kernel versions and NPCM845 device configurations
• Verify affected versions and configurations
• Apply patches or mitigations as recommended by the Linux kernel community
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references provide details on the Linux kernel vulnerability and its potential impact on NPCM845 devices. The issue arises when a target on the I3C bus gets stuck holding SDA low, causing the controller to report a false Master Request in-band interrupt event. To assess exposure, defenders should verify affected Linux kernel versions and NPCM845 device configurations. The Linux kernel community provides patches or mitigations for this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.