In the Linux kernel, the following vulnerability has been resolved:
i3c: Add NULL pointer check in i3cmasterqueue_ibi()
The I3C master driver may receive an IBI from a target device that has not
been probed yet. In such cases, the master calls i3c_master_queue_ibi()
to queue an IBI work task, leading to "Unable to handle kernel read from
unreadable memory" and resulting in a kernel panic.
Typical IBI handling flow:
1. The I3C master scans target devices and probes their respective drivers.
2. The target device driver calls i3c_device_request_ibi() to enable IBI
and assigns dev->ibi = ibi.
3. The I3C master receives an IBI from the target device and calls
i3c_master_queue_ibi() to queue the target device driver’s IBI
handler task.
However, since target device events are asynchronous to the I3C probe
sequence, step 3 may occur before step 2, causing dev->ibi to be NULL,
leading to a kernel panic.
Add a NULL pointer check in i3c_master_queue_ibi() to prevent accessing
an uninitialized dev->ibi, ensuring stability.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23147.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23147.json"
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09359e7c8751961937cb5fc50220969b0a4e1058",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-23147-4c50a23d",
"digest": {
"length": 162.0,
"function_hash": "176277220583000129625412465285028521954"
},
"signature_type": "Function",
"target": {
"file": "drivers/i3c/master.c",
"function": "i3c_master_queue_ibi"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe4a4fc179b7898055555a11685915473588392e",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-23147-56ca0930",
"digest": {
"length": 150.0,
"function_hash": "170521670601402829250106477699208606704"
},
"signature_type": "Function",
"target": {
"file": "drivers/i3c/master.c",
"function": "i3c_master_queue_ibi"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09359e7c8751961937cb5fc50220969b0a4e1058",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-23147-8aa7c3bd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"124238258949212480985693859104272245580",
"329935039222721181346987826355776196067",
"231693320237126862931964891699387550519",
"234816777416526449661484297528023015770"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/i3c/master.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe4a4fc179b7898055555a11685915473588392e",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-23147-b353006b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"124238258949212480985693859104272245580",
"329935039222721181346987826355776196067",
"185434681780924622226113575386581768738",
"137056617097185052872718048379830208910"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/i3c/master.c"
}
}
]