A failure in the Linux kernel I3C driver initialization process can lead to memory leaks and invalid state references, potentially allowing local privilege escalation.

The vulnerability stems from an error handling flaw in the mctp_i3c_mod_init function. When i3c_driver_register fails, the kernel fails to unregister the previously initialized I3C bus notifier and fails to free allocated mctp_i3c_bus objects, requiring local authenticated access to trigger.

The vulnerability carries a CVSS score of 7.8, indicating a high risk of local exploitation. Successful exploitation allows a local attacker to cause kernel memory leaks or potentially trigger use-after-free conditions, leading to system instability, denial of service, or escalation of privileges to the kernel level.

Immediate Action: Update the Linux kernel to version 6.12.101, 6.18.42, 7.1.6, or newer, as these releases contain the necessary cleanup logic to handle failed driver registrations safely.

Proactive Monitoring: Monitor system logs for kernel oops or panic events occurring during module loading or hardware initialization phases.

Compensating Controls: Restrict access to local system resources and hardware interfaces to authorized users only, minimizing the attack surface for local exploitation.

Public Exploit Available: No (exploit_available: false)

While this vulnerability requires local access, the potential for kernel-level impact makes it a priority for system hardening. Administrators should prioritize patching the kernel to the specified fixed versions in their next maintenance cycle to eliminate the underlying resource management flaw.