CVE-2026-93283
Received Received - Intake

Memory Leak in Linux Kernel i3c Subsystem

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix device_register() error path When device_register() fails in i3c_master_register_new_i3c_devs(), put_device() is called to drop the reference taken by device_register(). That drops the last reference, so the device's release callback i3c_device_release() runs and frees the i3c_device. Two problems follow from that: i3c_device_release() does WARN_ON(i3cdev->desc), so it warns because desc->dev->desc still points back at the descriptor. Clear it before calling put_device(). After put_device() frees the i3c_device, desc->dev is left pointing at freed memory, so clear desc->dev as well. That prevents, for example, i3c_master_unregister_i3c_devs() seeing desc->dev as non-NULL and dereferencing it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93283
EUVD
EUVD-2026-86155

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where device_register() fails in i3c_master_register_new_i3c_devs(). The issue occurs when put_device() is called to drop the reference, triggering the device's release callback i3c_device_release() which frees the i3c_device. This causes a use-after-free scenario where desc->dev points to freed memory, potentially leading to crashes or other undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's I3C subsystem and does not have a direct network detection method. Detection involves checking the kernel version and verifying if the vulnerable code path exists in the running kernel. Use commands like 'uname -a' to check the kernel version and 'dmesg' or 'journalctl' to look for related warnings or errors.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior in systems using the affected Linux kernel component. It may lead to denial-of-service conditions or potential privilege escalation if exploited.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If an update is not immediately available, consider disabling the I3C subsystem if not in use or restricting access to affected systems until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93283. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart