{"id":"CVE-2026-14367","summary":"I3C IBI work-node free-list data race between ISR and workqueue thread","details":"The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a plain sys_slist_t, which provides no synchronization. The allocation helpers (i3c_ibi_work_enqueue, i3c_ibi_work_enqueue_target_irq, i3c_ibi_work_enqueue_hotjoin, i3c_ibi_work_enqueue_controller_request, i3c_ibi_work_enqueue_cb) called sys_slist_get() directly from ISR context, while the workqueue handler i3c_ibi_work_handler() returned nodes with sys_slist_append() from the workqueue thread, with no lock on either side.\n\nBecause sys_slist_get() and sys_slist_append() are neither atomic nor interrupt-safe, an IBI interrupt that fires while the workqueue thread is mid-append (or a truly parallel access under CONFIG_SMP) races on the shared list. This corrupts the list linkage: a node may be handed to two consumers, a node may be lost, or the head/tail pointers may be left inconsistent so sys_slist_get() returns a stale or garbage pointer. In the double-hand-out case the subsequent memcpy(ibi_node, ibi_work, sizeof(*ibi_node)) overwrites a node still in flight; a garbage pointer turns the same memcpy into an out-of-bounds write.\n\nThe race is driven by I3C bus traffic — IBIs, hot-joins, and controller-role requests originate from target devices on the bus, and I3C supports hot-joining devices. An attacker controlling an I3C peripheral on the board's chip-to-chip bus can generate high-frequency interrupts timed to collide with the free operation. Exploitation requires physical access to the bus and winning a narrow timing window; the most realistic impact is a crash or hang (denial of service), with memory corruption possible but hard to control.\n\nThe fix wraps all free-list sys_slist_get()/sys_slist_append() operations in the new ibi_work_alloc()/ibi_work_free() helpers, each guarded by a k_spinlock (ibi_work_lock), closing the race across ISR and thread contexts.","aliases":["GHSA-gfj5-gcxv-9jqm"],"modified":"2026-09-03T08:07:09.159264Z","published":"2026-08-31T18:13:15.626Z","database_specific":{"cna_assigner":"zephyr","cwe_ids":["CWE-362"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14367.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14367.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gfj5-gcxv-9jqm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14367"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"4256cd41df6c60f1832fd2deb14edc30ac7debab"},{"fixed":"e87e7e2ac7c5ded0af3fb5934518cc5688e458cc"}],"database_specific":{"extracted_events":[{"introduced":"3.2.0"},{"fixed":"4.4.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0","v3.6.0-rc3","v3.6.0-rc2","v3.6.0-rc1","zephyr-v3.5.0","v3.5.0","v3.5.0-rc3","v3.5.0-rc2","v3.5.0-rc1","zephyr-v3.4.0","v3.4.0","v3.4.0-rc3","v3.4.0-rc2","v3.4.0-rc1","zephyr-v3.3.0","v3.3.0","v3.3.0-rc3","v3.3.0-rc2","v3.3.0-rc1","zephyr-v3.2.0","v3.2.0"],"database_specific":{"vanir_signatures_modified":"2026-09-03T08:07:09Z","vanir_signatures":[{"target":{"file":"drivers/i3c/i3c_ibi_workq.c","function":"i3c_ibi_work_handler"},"deprecated":false,"digest":{"function_hash":"272255904022761334324969246021023830247","length":2013},"id":"CVE-2026-14367-53012308","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc"},{"id":"CVE-2026-14367-8b389718","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc","target":{"file":"drivers/i3c/i3c_ibi_workq.c"},"deprecated":false,"digest":{"line_hashes":["214670425338353404436501673949915951892","171235512154751973838649447351216274501","48918003839189766745104941314046669024","8767354229259807487863073445320701529","258044901122772059813860144767523487741","215888717602986581480611818046207687163","64093506358938322256435977547051713310","26601582307578820198425184371002004315","292073259630724876043871324088588455750","335746605222840410194617116794563461261","223426563587465698151271650911479191200","106787159439333510125892618262047656741","306671596105021606723565840279316935555","4492242070341436705545112940525600498","60117476739214021112355815935311301786","130954374578358842421548033130687406430","123631467600494053246138250245989334155","283761261295960780233506868346239201658","80616835497015648332642079971510457545","29103807711737593254871103867565087583","292073259630724876043871324088588455750","335746605222840410194617116794563461261","223426563587465698151271650911479191200","106787159439333510125892618262047656741","306671596105021606723565840279316935555","4492242070341436705545112940525600498","60117476739214021112355815935311301786","48986700975387457319246976089563895381","72007034279595099422976621220921363626","155067900394381029960935636547336216665","226934284455791990700566954274304827675","185614181937380049309500859076183877609","292073259630724876043871324088588455750","335746605222840410194617116794563461261","223426563587465698151271650911479191200","106787159439333510125892618262047656741","306671596105021606723565840279316935555","4492242070341436705545112940525600498","60117476739214021112355815935311301786","210592834916847224449871921571960640883","124802572908700230836561118527635428243","1349704617031324451493231169501776235","135657150478516685984201204836354267074","216324117239004919782130260005097416330","292073259630724876043871324088588455750","335746605222840410194617116794563461261","223426563587465698151271650911479191200","106787159439333510125892618262047656741","306671596105021606723565840279316935555","4492242070341436705545112940525600498","60117476739214021112355815935311301786","309146729886983787285324704882213669978","182907737596055987208627226691267704953","166046051446706218114862849717433707601","8702105953136714921256932522822576423","131758218639255507263100341373317018189","292073259630724876043871324088588455750","335746605222840410194617116794563461261","223426563587465698151271650911479191200","106787159439333510125892618262047656741","306671596105021606723565840279316935555","4492242070341436705545112940525600498","60117476739214021112355815935311301786","18981400529909147456947956943410928559","184669478060621684186088749202409463731","155907154279887056948780149075951569391","163073795711991950841407472437900477066","27943772441096713304485705657252416609","188517695459517058715089519874443722389","112201012433687254665181844656843702710"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc","target":{"file":"drivers/i3c/i3c_ibi_workq.c","function":"i3c_ibi_work_enqueue_target_irq"},"deprecated":false,"digest":{"function_hash":"228175844605962670338607669149061533440","length":509},"id":"CVE-2026-14367-ae2bdb59","signature_type":"Function"},{"id":"CVE-2026-14367-ba0223c4","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc","target":{"file":"drivers/i3c/i3c_ibi_workq.c","function":"i3c_ibi_work_enqueue"},"deprecated":false,"digest":{"function_hash":"247168384817398977281801354843534960016","length":328}},{"deprecated":false,"digest":{"function_hash":"264768707350783351056997890833665864976","length":343},"id":"CVE-2026-14367-c80b04e1","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc","target":{"file":"drivers/i3c/i3c_ibi_workq.c","function":"i3c_ibi_work_enqueue_controller_request"}},{"id":"CVE-2026-14367-ca32fd62","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc","target":{"file":"drivers/i3c/i3c_ibi_workq.c","function":"i3c_ibi_work_enqueue_cb"},"deprecated":false,"digest":{"function_hash":"137317057183191495203517575389439799353","length":380}},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc","target":{"file":"drivers/i3c/i3c_ibi_workq.c","function":"i3c_ibi_work_enqueue_hotjoin"},"deprecated":false,"digest":{"function_hash":"253658208096532482155938579098336766024","length":373},"id":"CVE-2026-14367-e332f9b9","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14367.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}