CVE-2025-23147

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

i3c: Add NULL pointer check in i3c_master_queue_ibi()

The I3C master driver may receive an IBI from a target device that has not

been probed yet. In such cases, the master calls `i3c_master_queue_ibi()`

to queue an IBI work task, leading to "Unable to handle kernel read from

unreadable memory" and resulting in a kernel panic.

Typical IBI handling flow:

1. The I3C master scans target devices and probes their respective drivers.

2. The target device driver calls `i3c_device_request_ibi()` to enable IBI

and assigns `dev->ibi = ibi`.

3. The I3C master receives an IBI from the target device and calls

`i3c_master_queue_ibi()` to queue the target device driver’s IBI

handler task.

However, since target device events are asynchronous to the I3C probe

sequence, step 3 may occur before step 2, causing `dev->ibi` to be `NULL`,

leading to a kernel panic.

Add a NULL pointer check in `i3c_master_queue_ibi()` to prevent

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References