CVE-2026-93283: i3c: master: Fix device_register() error path
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: Fix deviceregister() error path
When deviceregister() fails in i3cmasterregisternewi3cdevs(), putdevice() is called to drop the reference taken by deviceregister(). That drops the last reference, so the device's release callback i3cdevicerelease() runs and frees the i3cdevice.
Two problems follow from that:
i3cdevicerelease() does WARNON(i3cdev->desc), so it warns because desc->dev->desc still points back at the descriptor. Clear it before calling putdevice().
After putdevice() frees the i3cdevice, desc->dev is left pointing at freed memory, so clear desc->dev as well. That prevents, for example, i3cmasterunregisteri3cdevs() seeing desc->dev as non-NULL and dereferencing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the i3c_master_register_new_i3c_devs() device_register() failure path, clear desc->dev before calling put_device() so the descriptor does not retain a pointer to the freed i3c_device.
Event History
Frequently Asked Questions
Under what condition can this issue occur?
It occurs when device_register() fails while i3c_master_register_new_i3c_devs() is registering a new I3C device.
What is the consequence after the registration failure?
The descriptor can retain a pointer to an i3c_device that has already been freed. A later i3c_master_unregister_i3c_devs() call may treat that pointer as valid and dereference freed memory.
What does the fix change?
The fix clears the descriptor's back-reference before put_device() triggers the release callback, and clears desc->dev after the device is freed. This avoids the release-callback warning and prevents later use of the stale pointer.