In the Linux kernel, the following vulnerability has been resolved:
i3c: Add NULL pointer check in i3cmasterqueue_ibi()
The I3C master driver may receive an IBI from a target device that has not
been probed yet. In such cases, the master calls i3c_master_queue_ibi()
to queue an IBI work task, leading to "Unable to handle kernel read from
unreadable memory" and resulting in a kernel panic.
Typical IBI handling flow:
1. The I3C master scans target devices and probes their respective drivers.
2. The target device driver calls i3c_device_request_ibi() to enable IBI
and assigns dev->ibi = ibi.
3. The I3C master receives an IBI from the target device and calls
i3c_master_queue_ibi() to queue the target device driver’s IBI
handler task.
However, since target device events are asynchronous to the I3C probe
sequence, step 3 may occur before step 2, causing dev->ibi to be NULL,
leading to a kernel panic.
Add a NULL pointer check in i3c_master_queue_ibi() to prevent accessing
an uninitialized dev->ibi, ensuring stability.
[
{
"target": {
"function": "i3c_master_queue_ibi",
"file": "drivers/i3c/master.c"
},
"digest": {
"length": 150.0,
"function_hash": "170521670601402829250106477699208606704"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff9d61db59bb27d16d3f872bff2620d50856b80c",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-23147-3caf140d"
},
{
"target": {
"file": "drivers/i3c/master.c"
},
"digest": {
"line_hashes": [
"124238258949212480985693859104272245580",
"329935039222721181346987826355776196067",
"185434681780924622226113575386581768738",
"137056617097185052872718048379830208910"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6bba328578feb58c614c11868c259b40484c5fa",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-23147-404b583b"
},
{
"target": {
"function": "i3c_master_queue_ibi",
"file": "drivers/i3c/master.c"
},
"digest": {
"length": 162.0,
"function_hash": "176277220583000129625412465285028521954"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ba402610843d7d15c7f3966a461deeeaff7fba4",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-23147-460cf631"
},
{
"target": {
"function": "i3c_master_queue_ibi",
"file": "drivers/i3c/master.c"
},
"digest": {
"length": 162.0,
"function_hash": "176277220583000129625412465285028521954"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b54faa5f47fa7c642179744aeff03f0810dc62e",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-23147-4a4399e3"
},
{
"target": {
"function": "i3c_master_queue_ibi",
"file": "drivers/i3c/master.c"
},
"digest": {
"length": 150.0,
"function_hash": "170521670601402829250106477699208606704"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe4a4fc179b7898055555a11685915473588392e",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-23147-56ca0930"
},
{
"target": {
"file": "drivers/i3c/master.c"
},
"digest": {
"line_hashes": [
"124238258949212480985693859104272245580",
"329935039222721181346987826355776196067",
"185434681780924622226113575386581768738",
"137056617097185052872718048379830208910"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff9d61db59bb27d16d3f872bff2620d50856b80c",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-23147-6ad5853e"
},
{
"target": {
"file": "drivers/i3c/master.c"
},
"digest": {
"line_hashes": [
"124238258949212480985693859104272245580",
"329935039222721181346987826355776196067",
"231693320237126862931964891699387550519",
"234816777416526449661484297528023015770"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b54faa5f47fa7c642179744aeff03f0810dc62e",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-23147-a92cab28"
},
{
"target": {
"file": "drivers/i3c/master.c"
},
"digest": {
"line_hashes": [
"124238258949212480985693859104272245580",
"329935039222721181346987826355776196067",
"185434681780924622226113575386581768738",
"137056617097185052872718048379830208910"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe4a4fc179b7898055555a11685915473588392e",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-23147-b353006b"
},
{
"target": {
"function": "i3c_master_queue_ibi",
"file": "drivers/i3c/master.c"
},
"digest": {
"length": 162.0,
"function_hash": "176277220583000129625412465285028521954"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6871a676aa534e8f218279672e0445c725f81026",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-23147-b53fb494"
},
{
"target": {
"function": "i3c_master_queue_ibi",
"file": "drivers/i3c/master.c"
},
"digest": {
"length": 150.0,
"function_hash": "170521670601402829250106477699208606704"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6bba328578feb58c614c11868c259b40484c5fa",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-23147-bc2eacf0"
},
{
"target": {
"file": "drivers/i3c/master.c"
},
"digest": {
"line_hashes": [
"124238258949212480985693859104272245580",
"329935039222721181346987826355776196067",
"231693320237126862931964891699387550519",
"234816777416526449661484297528023015770"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ba402610843d7d15c7f3966a461deeeaff7fba4",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-23147-d7175f8b"
},
{
"target": {
"file": "drivers/i3c/master.c"
},
"digest": {
"line_hashes": [
"124238258949212480985693859104272245580",
"329935039222721181346987826355776196067",
"231693320237126862931964891699387550519",
"234816777416526449661484297528023015770"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6871a676aa534e8f218279672e0445c725f81026",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-23147-eb88f157"
}
]