---
id: CVE-2026-80951
title: 'i3c: master: svc: bound IBI payload to the requested max_payload_len'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  i3c: master: svc: bound IBI payload to the requested max_payload_len

  svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into
  the IBI slot. The loop is …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe:
  - CWE-787
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 <
    7c099b0b292a68d0ef558527945dbfb756fbf893
  - >-
    Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 <
    7cc5ba756bc1cfffab9cb2695742f9f479dc73f7
  - >-
    Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 <
    35aa6730b8c5626b879a4e893fe664f59bf07d7f
  - >-
    Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 <
    f296a0d5907bf88314dfda67245f7f69d1552470
  - >-
    Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 <
    5697d779577e2786ff3348ae9b77020ac0cf0aab
  - >-
    Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 <
    aac3c5aababc7fb69d5bf5b0cc52d308574e3a8c
  - >-
    Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 <
    e2bda39d7f9f285ec803e200b5c1f17143d0b483
  - Linux 5.12
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:45:35.194Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80951'
references:
  - url: 'https://git.kernel.org/stable/c/7c099b0b292a68d0ef558527945dbfb756fbf893'
  - url: 'https://git.kernel.org/stable/c/7cc5ba756bc1cfffab9cb2695742f9f479dc73f7'
  - url: 'https://git.kernel.org/stable/c/35aa6730b8c5626b879a4e893fe664f59bf07d7f'
  - url: 'https://git.kernel.org/stable/c/f296a0d5907bf88314dfda67245f7f69d1552470'
  - url: 'https://git.kernel.org/stable/c/5697d779577e2786ff3348ae9b77020ac0cf0aab'
  - url: 'https://git.kernel.org/stable/c/aac3c5aababc7fb69d5bf5b0cc52d308574e3a8c'
  - url: 'https://git.kernel.org/stable/c/e2bda39d7f9f285ec803e200b5c1f17143d0b483'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80951.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80951'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532522'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80951'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80951'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80951.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00211
epssPercentile: 0.11315
ingestedAt: '2026-09-14T15:23:07.455Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

i3c: master: svc: bound IBI payload to the requested max_payload_len

svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into
the IBI slot. The loop is bounded by the hardware FIFO size
(SVC_I3C_FIFO_SIZE), not by the slot size.

slot->data points into the IBI pool, which i3c_generic_ibi_alloc_pool()
sizes at max_payload_len per slot. svc_i3c_master_request_ibi() only
rejects a max_payload_len larger than SVC_I3C_FIFO_SIZE, so a driver can
request a smaller one. mctp-i3c requests 1. Each readsb() then copies the
controller RXCOUNT bytes (up to 31) with no check against the slot size.
A device that sends more bytes than the slot holds writes past
slot->data, an out-of-bounds write into the IBI pool.

Bound the loop by dev->ibi->max_payload_len and clamp each read to the
space left in the slot, the same way dw-i3c does. A device can still send
more than the requested payload. Flush the leftover bytes from the RX FIFO
so they do not leak into the next transfer.

## Affected

- `Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 < 7c099b0b292a68d0ef558527945dbfb756fbf893`
- `Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 < 7cc5ba756bc1cfffab9cb2695742f9f479dc73f7`
- `Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 < 35aa6730b8c5626b879a4e893fe664f59bf07d7f`
- `Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 < f296a0d5907bf88314dfda67245f7f69d1552470`
- `Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 < 5697d779577e2786ff3348ae9b77020ac0cf0aab`
- `Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 < aac3c5aababc7fb69d5bf5b0cc52d308574e3a8c`
- `Linux >= dd3c52846d5954acd43f0e771689302f27dadc28 < e2bda39d7f9f285ec803e200b5c1f17143d0b483`
- `Linux 5.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-27 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80951.json)