Linux Kernel NULL Pointer Dereference Vulnerability in MIPI I3C Bus Management

A vulnerability in the Linux kernel's handling of the MIPI I3C bus in DMA mode can lead to a NULL pointer dereference. This issue arises when the bus cleanup process triggers a RING_OP_STAT interrupt while the ring is being stopped. If the interrupt handler executes after the io_data pointer has been nullified, it can cause a crash in the hci_dma_irq_handler(). The vulnerability has been addressed by masking the ring interrupts before initiating the ring stop request.

Impact

Exploitation of this vulnerability causes a NULL pointer dereference, leading to a system crash.