CVE-2026-93283

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

i3c: master: Fix device_register() error path

When device_register() fails in i3c_master_register_new_i3c_devs(),

put_device() is called to drop the reference taken by

device_register(). That drops the last reference, so the device's

release callback i3c_device_release() runs and frees the i3c_device.

Two problems follow from that:

i3c_device_release() does WARN_ON(i3cdev->desc), so it warns because

desc->dev->desc still points back at the descriptor. Clear it before

calling put_device().

After put_device() frees the i3c_device, desc->dev is left pointing at

freed memory, so clear desc->dev as well. That prevents, for example,

i3c_master_unregister_i3c_devs() seeing desc->dev as non-NULL and

dereferencing it.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References