CVE-2026-93200

i3c: master: Fix use-after-free of master->this

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

i3c: master: Fix use-after-free of master->this

sysfs attribute callbacks for the master controller device dereference master->this. However, master->this is freed in i3c_master_detach_free_devs() before the master device itself is released.

As a result, sysfs accesses can dereference a freed master->this pointer, leading to a use-after-free.

Keep master->this alive until i3c_masterdev_release(), which is called after the master device and its sysfs state are being torn down. Do not free master->this as part of the normal device detach path.

On the error path in i3c_master_set_info(), reset master->this and bus.cur_master to NULL before freeing the allocated device.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before a9b9cae0bd887ef0d438887f20b0a417491e45f0Affected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 94af669037d129914828a851d8b2a79b4537b73fAffected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before e766605a0490723df7b61e6abd0c392889732dd7Affected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 027679d613ea73b8a00831369ec34eea804ce1bdAffected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 23a1c4288a60e253a05a882bd8928ed61beb4a48Affected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 4f3145db05fede36b35f8249b8acde5bd5d54864Affected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 50034d8d0f797c3a7a599f750a7d3e792e80dea5Affected 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before feb0ed76601f3c2f91f08688c5a7d8b9d382f720Affected
LinuxLinux	5.0Affected before 5.0Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before a9b9cae0bd887ef0d438887f20b0a417491e45f0Affected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 94af669037d129914828a851d8b2a79b4537b73fAffected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before e766605a0490723df7b61e6abd0c392889732dd7Affected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 027679d613ea73b8a00831369ec34eea804ce1bdAffected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 23a1c4288a60e253a05a882bd8928ed61beb4a48Affected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 4f3145db05fede36b35f8249b8acde5bd5d54864Affected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before 50034d8d0f797c3a7a599f750a7d3e792e80dea5Affected
3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 to before feb0ed76601f3c2f91f08688c5a7d8b9d382f720Affected

LinuxLinux

5.0Affected
before 5.0Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.