CVE-2026-93199

i3c: master: Do not treat master device as a duplicate target

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

i3c: master: Do not treat master device as a duplicate target

i3c_master_search_i3c_dev_duplicate() searches the bus for another I3C device with the same PID as the reference device. The search can match master->this, causing the controller itself to be returned as a duplicate.

Since the controller is not a target device, it cannot be a duplicate of one. Exclude master->this from matching so that the function only returns real duplicate target devices.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 3728d90ec66d4ad33d357e7d6e82b02d34e1c99cAffected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 6f2340857fc206e7ebfc50c568fb65c3055e568bAffected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before d72a5e9060030a1c205b54157c15a428b741d83fAffected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 7b25b755d59077dd9484ba1360b8fe6396e5ccfbAffected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 533faf3d2e67ded0a62b7ba753c0fe993d1dfc26Affected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before d0cc00957292e353ad46039034cd8f82fc4f8057Affected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 150e71808d3715a0deefbb189c780d03fdbdc735Affected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 4dc1b3eeba7991905a5b5b8129ebea51be7d87b7Affected
LinuxLinux	5.0Affected before 5.0Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 3728d90ec66d4ad33d357e7d6e82b02d34e1c99cAffected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 6f2340857fc206e7ebfc50c568fb65c3055e568bAffected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before d72a5e9060030a1c205b54157c15a428b741d83fAffected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 7b25b755d59077dd9484ba1360b8fe6396e5ccfbAffected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 533faf3d2e67ded0a62b7ba753c0fe993d1dfc26Affected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before d0cc00957292e353ad46039034cd8f82fc4f8057Affected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 150e71808d3715a0deefbb189c780d03fdbdc735Affected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 4dc1b3eeba7991905a5b5b8129ebea51be7d87b7Affected

LinuxLinux

5.0Affected
before 5.0Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.