CVE-2026-93200

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

i3c: master: Fix use-after-free of master->this

sysfs attribute callbacks for the master controller device dereference

master->this. However, master->this is freed in

i3c_master_detach_free_devs() before the master device itself is

released.

As a result, sysfs accesses can dereference a freed master->this

pointer, leading to a use-after-free.

Keep master->this alive until i3c_masterdev_release(), which is called

after the master device and its sysfs state are being torn down. Do not

free master->this as part of the normal device detach path.

On the error path in i3c_master_set_info(), reset master->this and

bus.cur_master to NULL before freeing the allocated device.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References