Device Reference Handling Issue in Linux Kernel i3c Protocol

CVE-2026-93283

What is CVE-2026-93283?

A vulnerability in the Linux kernel's i3c protocol can lead to improper handling during device registration processes. When the device_register() function fails within the i3c_master_register_new_i3c_devs() routine, it inadvertently triggers the release of the associated i3c_device, leading to potential memory access issues. Specifically, the device's release callback does not correctly clear pointers to device descriptors, which can leave dangling references to freed memory. This oversight can compromise system stability and security, necessitating caution during device management.

References