UBUNTU-CVE-2026-93200: Use After Free
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix use-after-free of master->this sysfs attribute callbacks for the master controller device dereference master->this. However, master->this is freed in i3cmasterdetachfreedevs() before the master device itself is released. As a result, sysfs accesses can dereference a freed master->this pointer, leading to a use-after-free. Keep master->this alive until i3cmasterdevrelease(), which is called after the master device and its sysfs state are being torn down. Do not free master->this as part of the normal device detach path. On the error path in i3cmastersetinfo(), reset master->this and bus.curmaster to NULL before freeing the allocated device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the i3c master implementation, keep master->this alive until i3c_masterdev_release() after the master device and its sysfs state are torn down; do not free it during the normal device detach path. In the i3c_master_set_info() error path, reset master->this and bus.cur_master to NULL before freeing the allocated device.
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue applies to the listed Ubuntu kernel packages: linux, linux-azure, linux-gcp, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, and linux-realtime. The affected code is in the Linux kernel I3C master subsystem.
What condition is required to trigger the use-after-free?
A sysfs callback for an I3C master controller must access master->this after the normal device-detach path has freed that object. The vulnerability arises from the mismatch between freeing master->this during detach and tearing down the master device's sysfs state later.
How can administrators determine whether a system is potentially exposed?
Identify whether the running or installed Ubuntu kernel is one of the listed packages and whether the system uses the kernel I3C master subsystem. The provided data does not include affected or fixed package versions.
What does the fix change?
The fix retains master->this until i3c_masterdev_release(), after the master device and its sysfs state are being torn down. It also clears master->this and bus.cur_master before freeing the allocated device on the i3c_master_set_info() error path.