CVE-2026-97515 (GCVE-0-2026-97515)
Vulnerability from cvelistv5
Published
2026-09-24 16:05
Modified
2026-10-21 12:53
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 On NPCM845, when a target on the I3C bus gets stuck holding SDA low, the controller reports a false Master Request (MR) in-band interrupt event. The driver handles this by emitting a STOP condition to restore the bus. However, the hardware quirk SVC_I3C_QUIRK_FALSE_SLVSTART indicates that emitting a STOP condition may spuriously set the SLVSTART interrupt status bit. In the Master Request case, this creates a feedback loop: the STOP triggers a new SLVSTART event, the IRQ handler fires again, the controller still reports an MR type, another STOP is emitted, and the cycle repeats indefinitely, resulting in an IRQ storm that can lock up the CPU. Clear the SLVSTART status bit explicitly after emitting the STOP in the Master Request IBI handler when the SVC_I3C_QUIRK_FALSE_SLVSTART quirk is set. This breaks the feedback loop without affecting normal SLVSTART processing, which is already guarded in the top-level IRQ handler by checking that MSTATUS is in SLVREQ state.
References
Impacted products
Vendor Product Version
Linux Linux Version: 1ea4653cff35c29d1dd0b14ad9c8245e7318f337
Version: 0430bf9bc1ac068c8b8c540eb93e5751872efc51
Version: 0430bf9bc1ac068c8b8c540eb93e5751872efc51
Version: 30748ce7e156f221fb91689b338a0d7df77b732a
Version: f2985a1de6f53abbc42c7a696ee6ba8bdecc9426
Version: 0541822045ae043d62c941ca31fa76871e436b5e
Version: d231fb443d8d4042f0dd705b93beba8c916a7344
Version: 6.12.31   ≤
Version: 5.15.185   ≤
Version: 6.1.141   ≤
Version: 6.6.93   ≤
Version: 6.14.9   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i3c/master/svc-i3c-master.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "335f72b1f9bbcf0f4cc5a505443b15f1af563b4f",
              "status": "affected",
              "version": "1ea4653cff35c29d1dd0b14ad9c8245e7318f337",
              "versionType": "git"
            },
            {
              "lessThan": "e9b139c4684ed8593a0b779ca02ea05f460b2eec",
              "status": "affected",
              "version": "0430bf9bc1ac068c8b8c540eb93e5751872efc51",
              "versionType": "git"
            },
            {
              "lessThan": "1effa3adfe53cb2bb28bf5640a676b791d5ab405",
              "status": "affected",
              "version": "0430bf9bc1ac068c8b8c540eb93e5751872efc51",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "30748ce7e156f221fb91689b338a0d7df77b732a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f2985a1de6f53abbc42c7a696ee6ba8bdecc9426",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0541822045ae043d62c941ca31fa76871e436b5e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d231fb443d8d4042f0dd705b93beba8c916a7344",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.114",
              "status": "affected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.185",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.141",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.93",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i3c/master/svc-i3c-master.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.12.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.185",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.141",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.93",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845\n\nOn NPCM845, when a target on the I3C bus gets stuck holding SDA low,\nthe controller reports a false Master Request (MR) in-band interrupt\nevent. The driver handles this by emitting a STOP condition to restore\nthe bus.\n\nHowever, the hardware quirk SVC_I3C_QUIRK_FALSE_SLVSTART indicates that\nemitting a STOP condition may spuriously set the SLVSTART interrupt\nstatus bit. In the Master Request case, this creates a feedback loop:\nthe STOP triggers a new SLVSTART event, the IRQ handler fires again,\nthe controller still reports an MR type, another STOP is emitted, and\nthe cycle repeats indefinitely, resulting in an IRQ storm that can lock\nup the CPU.\n\nClear the SLVSTART status bit explicitly after emitting the STOP in the\nMaster Request IBI handler when the SVC_I3C_QUIRK_FALSE_SLVSTART quirk\nis set. This breaks the feedback loop without affecting normal SLVSTART\nprocessing, which is already guarded in the top-level IRQ handler by\nchecking that MSTATUS is in SLVREQ state."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:53:00.686Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/335f72b1f9bbcf0f4cc5a505443b15f1af563b4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9b139c4684ed8593a0b779ca02ea05f460b2eec"
        },
        {
          "url": "https://git.kernel.org/stable/c/1effa3adfe53cb2bb28bf5640a676b791d5ab405"
        }
      ],
      "title": "i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97515",
    "datePublished": "2026-09-24T16:05:13.124Z",
    "dateReserved": "2026-09-24T16:01:01.152Z",
    "dateUpdated": "2026-10-21T12:53:00.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.