CVE-2026-14367 zephyrproject CVE debrief

Who should care

System administrators and developers who use the Zephyr operating system and have I3C bus devices connected to their systems should be aware of this vulnerability and take steps to mitigate it.

Why it matters

This vulnerability allows an attacker with physical access to the I3C bus to cause a denial of service or potentially memory corruption. System administrators and developers who use the Zephyr operating system and have I3C bus devices connected to their systems should review and apply the patch provided by the vendor, restrict access to the I3C bus to authorized devices and users, and monitor the system for suspicious activity.

• Denial of service due to system crash or hang
• Potential memory corruption requiring verification

Technical summary

The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a plain sys_slist_t, which provides no synchronization. The allocation helpers (i3c_ibi_work_enqueue, i3c_ibi_work_enqueue_target_irq, i3c_ibi_work_enqueue_hotjoin, i3c_ibi_work_enqueue_controller_request, i3c_ibi_work_enqueue_cb) called sys_slist_get() directly from ISR context, while the workqueue handler i3c_ibi_work_handler() returned nodes with sys_slist_append() from the workqueue thread, with no lock on either side.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch provided by the vendor
• Restrict access to the I3C bus to authorized devices and users
• Monitor the system for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by a race condition in the I3C IBI subsystem of the Zephyr operating system. An attacker with physical access to the I3C bus can generate high-frequency interrupts timed to collide with the free operation, leading to a denial of service or potentially memory corruption.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.