{"id":"CVE-2026-14367","title":"I3C IBI work-node free-list data race between ISR and workqueue thread","summary":"The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a plain sys_slist_t, which provides no synchronization. The allocation helpers (i3c…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-362"],"vendor":"zephyrproject","product":"zephyr","affected":["zephyr >= 3.2.0 < 4.3.2","zephyr >= 4.4.0 < 4.4.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-01T14:04:51.685369Z"},"published":"2026-08-31","updated":"2026-11-04","sourceUpdated":"2026-11-04T05:00:05.399Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-14367","references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc","label":"Fix commit"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gfj5-gcxv-9jqm","label":"GHSA-gfj5-gcxv-9jqm"}],"tags":["cve.org"],"epss":0.00136,"epssPercentile":0.03073,"ingestedAt":"2026-11-05T20:33:06.710Z","slug":"CVE-2026-14367","body":"## Overview\n\nThe I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a plain sys_slist_t, which provides no synchronization. The allocation helpers (i3c_ibi_work_enqueue, i3c_ibi_work_enqueue_target_irq, i3c_ibi_work_enqueue_hotjoin, i3c_ibi_work_enqueue_controller_request, i3c_ibi_work_enqueue_cb) called sys_slist_get() directly from ISR context, while the workqueue handler i3c_ibi_work_handler() returned nodes with sys_slist_append() from the workqueue thread, with no lock on either side.\n\nBecause sys_slist_get() and sys_slist_append() are neither atomic nor interrupt-safe, an IBI interrupt that fires while the workqueue thread is mid-append (or a truly parallel access under CONFIG_SMP) races on the shared list. This corrupts the list linkage: a node may be handed to two consumers, a node may be lost, or the head/tail pointers may be left inconsistent so sys_slist_get() returns a stale or garbage pointer. In the double-hand-out case the subsequent memcpy(ibi_node, ibi_work, sizeof(*ibi_node)) overwrites a node still in flight; a garbage pointer turns the same memcpy into an out-of-bounds write.\n\nThe race is driven by I3C bus traffic — IBIs, hot-joins, and controller-role requests originate from target devices on the bus, and I3C supports hot-joining devices. An attacker controlling an I3C peripheral on the board's chip-to-chip bus can generate high-frequency interrupts timed to collide with the free operation. Exploitation requires physical access to the bus and winning a narrow timing window; the most realistic impact is a crash or hang (denial of service), with memory corruption possible but hard to control.\n\nThe fix wraps all free-list sys_slist_get()/sys_slist_append() operations in the new ibi_work_alloc()/ibi_work_free() helpers, each guarded by a k_spinlock (ibi_work_lock), closing the race across ISR and thread contexts.\n\n## Affected\n\n- `zephyr >= 3.2.0 < 4.3.2`\n- `zephyr >= 4.4.0 < 4.4.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}