CVE-2026-80951

In the Linux kernel, the following vulnerability has been resolved:

i3c: master: svc: bound IBI payload to the requested max_payload_len

svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into

the IBI slot. The loop is bounded by the hardware FIFO size

(SVC_I3C_FIFO_SIZE), not by the slot size.

slot->data points into the IBI pool, which i3c_generic_ibi_alloc_pool()

sizes at max_payload_len per slot. svc_i3c_master_request_ibi() only

rejects a max_payload_len larger than SVC_I3C_FIFO_SIZE, so a driver can

request a smaller one. mctp-i3c requests 1. Each readsb() then copies the

controller RXCOUNT bytes (up to 31) with no check against the slot size.

A device that sends more bytes than the slot holds writes past

slot->data, an out-of-bounds write into the IBI pool.

Bound the loop by dev->ibi->max_payload_len and clamp each read to the

space left in the slot, the same way dw-i3c does. A device can still send

more than the requested payload. Flush the leftover bytes from the RX FIFO

so they do not leak into the next transfer.