{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-14367","assignerOrgId":"e2e69745-5e70-4e92-8431-deb5529a81ad","state":"PUBLISHED","assignerShortName":"zephyr","dateReserved":"2026-07-01T19:30:20.135Z","datePublished":"2026-08-31T18:13:15.626Z","dateUpdated":"2026-09-01T14:05:04.912Z"},"containers":{"cna":{"providerMetadata":{"orgId":"e2e69745-5e70-4e92-8431-deb5529a81ad","shortName":"zephyr","dateUpdated":"2026-08-31T18:13:15.626Z"},"title":"I3C IBI work-node free-list data race between ISR and workqueue thread","descriptions":[{"lang":"en","value":"The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a plain sys_slist_t, which provides no synchronization. The allocation helpers (i3c_ibi_work_enqueue, i3c_ibi_work_enqueue_target_irq, i3c_ibi_work_enqueue_hotjoin, i3c_ibi_work_enqueue_controller_request, i3c_ibi_work_enqueue_cb) called sys_slist_get() directly from ISR context, while the workqueue handler i3c_ibi_work_handler() returned nodes with sys_slist_append() from the workqueue thread, with no lock on either side.\n\nBecause sys_slist_get() and sys_slist_append() are neither atomic nor interrupt-safe, an IBI interrupt that fires while the workqueue thread is mid-append (or a truly parallel access under CONFIG_SMP) races on the shared list. This corrupts the list linkage: a node may be handed to two consumers, a node may be lost, or the head/tail pointers may be left inconsistent so sys_slist_get() returns a stale or garbage pointer. In the double-hand-out case the subsequent memcpy(ibi_node, ibi_work, sizeof(*ibi_node)) overwrites a node still in flight; a garbage pointer turns the same memcpy into an out-of-bounds write.\n\nThe race is driven by I3C bus traffic — IBIs, hot-joins, and controller-role requests originate from target devices on the bus, and I3C supports hot-joining devices. An attacker controlling an I3C peripheral on the board's chip-to-chip bus can generate high-frequency interrupts timed to collide with the free operation. Exploitation requires physical access to the bus and winning a narrow timing window; the most realistic impact is a crash or hang (denial of service), with memory corruption possible but hard to control.\n\nThe fix wraps all free-list sys_slist_get()/sys_slist_append() operations in the new ibi_work_alloc()/ibi_work_free() helpers, each guarded by a k_spinlock (ibi_work_lock), closing the race across ISR and thread contexts."}],"affected":[{"vendor":"zephyrproject","product":"zephyr","collectionURL":"https://github.com/zephyrproject-rtos/zephyr","packageName":"zephyr","defaultStatus":"unaffected","programFiles":["drivers/i3c/i3c_ibi_workq.c"],"programRoutines":[{"name":"i3c_ibi_work_enqueue"},{"name":"i3c_ibi_work_enqueue_cb"},{"name":"i3c_ibi_work_enqueue_controller_request"},{"name":"i3c_ibi_work_enqueue_hotjoin"},{"name":"i3c_ibi_work_enqueue_target_irq"},{"name":"i3c_ibi_work_handler"}],"versions":[{"version":"3.2.0","status":"affected","versionType":"semver","lessThan":"4.4.2"}]}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc","name":"Fix commit","tags":["patch"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gfj5-gcxv-9jqm","name":"GHSA-gfj5-gcxv-9jqm"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":3.1,"baseSeverity":"LOW"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"race","cweId":"CWE-362","type":"CWE"}]}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-01T14:04:51.685369Z","id":"CVE-2026-14367","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-01T14:05:04.912Z"}}]}}