Race Condition in I3C IBI Subsystem by Zephyr Project

CVE-2026-14367

What is CVE-2026-14367?

The I3C IBI subsystem in Zephyr RTOS suffers from a race condition due to unsynchronized access to a free-list of work nodes. It allows for the allocation helpers to be invoked from interrupt contexts, conflicting with the workqueue thread's operations, leading to potential crashes or hangs. This vulnerability poses a risk primarily in environments where an attacker with physical access can exploit high-frequency interrupts, resulting in possible list corruption, stale pointers, and unpredictable behavior. A fix has been implemented to ensure that all free-list operations are protected by a spinlock, effectively mitigating the race condition.

References