The Linux kernel's i3c master driver function svc_i3c_master_handle_ibi() previously read IBI payload data from the RX FIFO into a slot buffer without properly bounding the read loop by the slot size, instead using the hardware FIFO size. Since the slot size is determined by max_payload_len, which can be smaller than the FIFO size, a device sending more bytes than the slot size could cause out-of-bounds writes into the IBI pool memory. The fix bounds the loop by dev->ibi->max_payload_len and clamps each read to the remaining slot space, also flushing leftover bytes from the RX FIFO to avoid data leakage into subsequent transfers.

This vulnerability could lead to out-of-bounds memory writes in kernel space, potentially causing memory corruption. While the exact impact is not detailed, such memory corruption could lead to system instability or escalation of privileges if exploited. There are no known exploits in the wild at this time.

A fix has been implemented in the Linux kernel to properly bound the IBI payload reads by the requested max_payload_len and to flush leftover bytes from the RX FIFO. Users should apply the official kernel updates that include this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.