CVE-2026-14367

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14367
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14367.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14367
Aliases
  • GHSA-gfj5-gcxv-9jqm
Published
2026-08-31T18:13:15Z
Modified
2026-09-03T08:07:09Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
I3C IBI work-node free-list data race between ISR and workqueue thread
Details

The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a plain sys_slist_t, which provides no synchronization. The allocation helpers (i3c_ibi_work_enqueue, i3c_ibi_work_enqueue_target_irq, i3c_ibi_work_enqueue_hotjoin, i3c_ibi_work_enqueue_controller_request, i3c_ibi_work_enqueue_cb) called sys_slist_get() directly from ISR context, while the workqueue handler i3c_ibi_work_handler() returned nodes with sys_slist_append() from the workqueue thread, with no lock on either side.

Because sys_slist_get() and sys_slist_append() are neither atomic nor interrupt-safe, an IBI interrupt that fires while the workqueue thread is mid-append (or a truly parallel access under CONFIG_SMP) races on the shared list. This corrupts the list linkage: a node may be handed to two consumers, a node may be lost, or the head/tail pointers may be left inconsistent so sys_slist_get() returns a stale or garbage pointer. In the double-hand-out case the subsequent memcpy(ibi_node, ibi_work, sizeof(*ibi_node)) overwrites a node still in flight; a garbage pointer turns the same memcpy into an out-of-bounds write.

The race is driven by I3C bus traffic — IBIs, hot-joins, and controller-role requests originate from target devices on the bus, and I3C supports hot-joining devices. An attacker controlling an I3C peripheral on the board's chip-to-chip bus can generate high-frequency interrupts timed to collide with the free operation. Exploitation requires physical access to the bus and winning a narrow timing window; the most realistic impact is a crash or hang (denial of service), with memory corruption possible but hard to control.

The fix wraps all free-list sys_slist_get()/sys_slist_append() operations in the new ibi_work_alloc()/ibi_work_free() helpers, each guarded by a k_spinlock (ibi_work_lock), closing the race across ISR and thread contexts.

Database specific 
{
    "cna_assigner":  "zephyr",
    "cwe_ids":  [
        "CWE-362"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14367.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
4256cd41df6c60f1832fd2deb14edc30ac7debab
Fixed
e87e7e2ac7c5ded0af3fb5934518cc5688e458cc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "3.2.0"
        },
        {
            "fixed":  "4.4.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v3.*
v3.2.0
v3.3.0
v3.3.0-rc1
v3.3.0-rc2
v3.3.0-rc3
v3.4.0
v3.4.0-rc1
v3.4.0-rc2
v3.4.0-rc3
v3.5.0
v3.5.0-rc1
v3.5.0-rc2
v3.5.0-rc3
v3.6.0
v3.6.0-rc1
v3.6.0-rc2
v3.6.0-rc3
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.7.0-rc3
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3
zephyr-v3.*
zephyr-v3.2.0
zephyr-v3.3.0
zephyr-v3.4.0
zephyr-v3.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14367.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "272255904022761334324969246021023830247",
            "length":  2013
        },
        "id":  "CVE-2026-14367-53012308",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc",
        "target":  {
            "file":  "drivers/i3c/i3c_ibi_workq.c",
            "function":  "i3c_ibi_work_handler"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "214670425338353404436501673949915951892",
                "171235512154751973838649447351216274501",
                "48918003839189766745104941314046669024",
                "8767354229259807487863073445320701529",
                "258044901122772059813860144767523487741",
                "215888717602986581480611818046207687163",
                "64093506358938322256435977547051713310",
                "26601582307578820198425184371002004315",
                "292073259630724876043871324088588455750",
                "335746605222840410194617116794563461261",
                "223426563587465698151271650911479191200",
                "106787159439333510125892618262047656741",
                "306671596105021606723565840279316935555",
                "4492242070341436705545112940525600498",
                "60117476739214021112355815935311301786",
                "130954374578358842421548033130687406430",
                "123631467600494053246138250245989334155",
                "283761261295960780233506868346239201658",
                "80616835497015648332642079971510457545",
                "29103807711737593254871103867565087583",
                "292073259630724876043871324088588455750",
                "335746605222840410194617116794563461261",
                "223426563587465698151271650911479191200",
                "106787159439333510125892618262047656741",
                "306671596105021606723565840279316935555",
                "4492242070341436705545112940525600498",
                "60117476739214021112355815935311301786",
                "48986700975387457319246976089563895381",
                "72007034279595099422976621220921363626",
                "155067900394381029960935636547336216665",
                "226934284455791990700566954274304827675",
                "185614181937380049309500859076183877609",
                "292073259630724876043871324088588455750",
                "335746605222840410194617116794563461261",
                "223426563587465698151271650911479191200",
                "106787159439333510125892618262047656741",
                "306671596105021606723565840279316935555",
                "4492242070341436705545112940525600498",
                "60117476739214021112355815935311301786",
                "210592834916847224449871921571960640883",
                "124802572908700230836561118527635428243",
                "1349704617031324451493231169501776235",
                "135657150478516685984201204836354267074",
                "216324117239004919782130260005097416330",
                "292073259630724876043871324088588455750",
                "335746605222840410194617116794563461261",
                "223426563587465698151271650911479191200",
                "106787159439333510125892618262047656741",
                "306671596105021606723565840279316935555",
                "4492242070341436705545112940525600498",
                "60117476739214021112355815935311301786",
                "309146729886983787285324704882213669978",
                "182907737596055987208627226691267704953",
                "166046051446706218114862849717433707601",
                "8702105953136714921256932522822576423",
                "131758218639255507263100341373317018189",
                "292073259630724876043871324088588455750",
                "335746605222840410194617116794563461261",
                "223426563587465698151271650911479191200",
                "106787159439333510125892618262047656741",
                "306671596105021606723565840279316935555",
                "4492242070341436705545112940525600498",
                "60117476739214021112355815935311301786",
                "18981400529909147456947956943410928559",
                "184669478060621684186088749202409463731",
                "155907154279887056948780149075951569391",
                "163073795711991950841407472437900477066",
                "27943772441096713304485705657252416609",
                "188517695459517058715089519874443722389",
                "112201012433687254665181844656843702710"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-14367-8b389718",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc",
        "target":  {
            "file":  "drivers/i3c/i3c_ibi_workq.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "228175844605962670338607669149061533440",
            "length":  509
        },
        "id":  "CVE-2026-14367-ae2bdb59",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc",
        "target":  {
            "file":  "drivers/i3c/i3c_ibi_workq.c",
            "function":  "i3c_ibi_work_enqueue_target_irq"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "247168384817398977281801354843534960016",
            "length":  328
        },
        "id":  "CVE-2026-14367-ba0223c4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc",
        "target":  {
            "file":  "drivers/i3c/i3c_ibi_workq.c",
            "function":  "i3c_ibi_work_enqueue"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "264768707350783351056997890833665864976",
            "length":  343
        },
        "id":  "CVE-2026-14367-c80b04e1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc",
        "target":  {
            "file":  "drivers/i3c/i3c_ibi_workq.c",
            "function":  "i3c_ibi_work_enqueue_controller_request"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "137317057183191495203517575389439799353",
            "length":  380
        },
        "id":  "CVE-2026-14367-ca32fd62",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc",
        "target":  {
            "file":  "drivers/i3c/i3c_ibi_workq.c",
            "function":  "i3c_ibi_work_enqueue_cb"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "253658208096532482155938579098336766024",
            "length":  373
        },
        "id":  "CVE-2026-14367-e332f9b9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/e87e7e2ac7c5ded0af3fb5934518cc5688e458cc",
        "target":  {
            "file":  "drivers/i3c/i3c_ibi_workq.c",
            "function":  "i3c_ibi_work_enqueue_hotjoin"
        }
    }
]
vanir_signatures_modified 
"2026-09-03T08:07:09Z"