CVE-2026-93200i3c: master: Fix use-after-free of master->this
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix use-after-free of master->this sysfs attribute callbacks for the master controller device dereference master->this. However, master->this is freed in i3c_master_detach_free_devs() before the master device itself is released. As a result, sysfs accesses can dereference a freed master->this pointer, leading to a use-after-free. Keep master->this alive until i3c_masterdev_release(), which is called after the master device and its sysfs state are being torn down. Do not free master->this as part of the normal device detach path. On the error path in i3c_master_set_info(), reset master->this and bus.cur_master to NULL before freeing the allocated device.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 before 23a1c4288a60e253a05a882bd8928ed61beb4a48; from 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 before 4f3145db05fede36b35f8249b8acde5bd5d54864; from 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 before 50034d8d0f797c3a7a599f750a7d3e792e80dea5; from 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 before feb0ed76601f3c2f91f08688c5a7d8b9d382f720 | CNA record |
References
- https://git.kernel.org/stable/c/23a1c4288a60e253a05a882bd8928ed61beb4a48
- https://git.kernel.org/stable/c/4f3145db05fede36b35f8249b8acde5bd5d54864
- https://git.kernel.org/stable/c/50034d8d0f797c3a7a599f750a7d3e792e80dea5
- https://git.kernel.org/stable/c/feb0ed76601f3c2f91f08688c5a7d8b9d382f720
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.