# CVE-2026-97515: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845

> A hardware quirk in the NPCM845 I3C driver causes an infinite interrupt loop, leading to CPU lockup and denial of service.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 24 Sep 2026
- **Updated:** 21 Oct 2026
- **Also known as:** AZL-103820, BELL-CVE-2026-97515, DEBIAN-CVE-2026-97515, GHSA-jcmj-p262-2c6x, UBUNTU-CVE-2026-97515

## What is CVE-2026-97515?

CVE-2026-97515 is a denial of service vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845

On NPCM845, when a target on the I3C bus gets stuck holding SDA low,
the controller reports a false Master Request (MR) in-band interrupt
event. The driver handles this by emitting a STOP condition to restore
the bus.

However, the hardware quirk SVC_I3C_QUIRK_FALSE_SLVSTART indicates that
emitting a STOP condition may spuriously set the SLVSTART interrupt
status bit. In the Master Request case, this creates a feedback loop:
the STOP triggers a new SLVSTART event, the IRQ handler fires again,
the controller still reports an MR type, another STOP is emitted, and
the cycle repeats indefinitely, resulting in an IRQ storm that can lock
up the CPU.

Clear the SLVSTART status bit explicitly after emitting the STOP in the
Master Request IBI handler when the SVC_I3C_QUIRK_FALSE_SLVSTART quirk
is set. This breaks the feedback loop without affecting normal SLVSTART
processing, which is already guarded in the top-level IRQ handler by
checking that MSTATUS is in SLVREQ state.

## Which versions are affected by CVE-2026-97515?


## How do I fix CVE-2026-97515?

Apply the vendor's patch.

## Is CVE-2026-97515 being exploited?

There is no known exploitation of CVE-2026-97515 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-97515 and fix it if it is affected.

What it is: CVE-2026-97515 is a denial of service vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-97515 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-97515/ (Markdown: https://insights.sbomify.com/CVE-2026-97515/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-97515
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97515
- OSV: https://osv.dev/vulnerability/CVE-2026-97515

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-97515/
Summaries are generated and may contain mistakes; the official description above is the record.