# CVE-2026-80953: linux: In the Linux kernel, the following vulnerability has been resolved:  i3c: master: adi: initialize the lock before ena...

CVE-2026-80953 is fixed in linux on 1 platform by DEBIAN-CVE-2026-80953 (version 7.2.6-1), released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-80953
- Priority: High
- CVSS: 8.4 (high)
- EPSS: 0.0019
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 11, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  i3c: master: adi: initialize the lock before enabling interrupts  adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized.  A pending CMDR interrupt can therefore run adi_i3c_master_irq() and take master->xferqueue.lock before the dynamic lock has been initialized.  This issue was found by our static analysis tool and then manually reviewed against the current tree.  The grounded PoC kept the probe ordering and the IRQ path adi_i3c_master_probe() -> adi_i3c_master_irq() -> xferqueue.lock, with a pending CMDR interrupt arriving after REG_IRQ_PENDING_CMDR is unmasked. Lockdep reported:    INFO: trying to register non-static key.   you didn't initialize this object before use?   lock_acquire+0xbb/0x290   _raw_spin_lock_irqsave+0x36/0x60   adi_i3c_master_irq+0x32/0x56 [vuln_msv]   adi_i3c_master_probe+0x5a/0xf47 [vuln_msv]  Initialize the transfer queue and IBI state before requesting and unmasking the IRQ.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.6-1 | [DEBIAN-CVE-2026-80953](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80953.md) | Sep 23, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.