CVE-2026-93283
Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix device_register() error path When device_register() fails in i3c_master_register_new_i3c_devs(), put_device() is called to drop the reference taken by device_register(). That drops the last reference, so the device's release callback i3c_device_release() runs and frees the i3c_device. Two problems follow from that: i3c_device_release() does WARN_ON(i3cdev->desc), so it warns because desc->dev->desc still points back at the descriptor. Clear it before calling put_device(). After put_device() frees the i3c_device, desc->dev is left pointing at freed memory, so clear desc->dev as well. That prevents, for example, i3c_master_unregister_i3c_devs() seeing desc->dev as non-NULL and dereferencing it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-10-14
AI Q&A
2026-09-24
EPSS Evaluated
2026-10-13
NVD
CVE-2026-93283
EUVD
EUVD-2026-86155

Affected Vendors & Products

Showing 17 associated CPEs
Vendor Product Version / Range
Linux Linux 1832ed55df45f4145335ad992fb83813cdc58b5d
Linux Linux d48fe8d98171e0fffdeaa8b37ce0a6444bff819b
Linux Linux 174ae0a3b89e7804e4ea3d31bd83d6e43f39568c
Linux Linux e49a51a96b531f1b4bcd8d358e645b6c74ef67e6
Linux Linux cab63f64887616e3c4e31cfd8103320be6ebc8d3
Linux Linux cab63f64887616e3c4e31cfd8103320be6ebc8d3
Linux Linux cab63f64887616e3c4e31cfd8103320be6ebc8d3
Linux Linux cab63f64887616e3c4e31cfd8103320be6ebc8d3
Linux Linux 204beeb509d37669de34560e83bb8abffe7ee63a
Linux Linux b24cf43d9babf1265a2bb0ae8d198267cef43b83
Linux Linux 5.10.201
Linux Linux 5.15.139
Linux Linux 6.1.63
Linux Linux 6.6.2
Linux Linux 5.4.261
Linux Linux 6.5.12
Linux Linux 6.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where device_register() fails in i3c_master_register_new_i3c_devs(). The issue occurs when put_device() is called to drop the reference, triggering the device's release callback i3c_device_release() which frees the i3c_device. This causes a use-after-free scenario where desc->dev points to freed memory, potentially leading to crashes or other undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's I3C subsystem and does not have a direct network detection method. Detection involves checking the kernel version and verifying if the vulnerable code path exists in the running kernel. Use commands like 'uname -a' to check the kernel version and 'dmesg' or 'journalctl' to look for related warnings or errors.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior in systems using the affected Linux kernel component. It may lead to denial-of-service conditions or potential privilege escalation if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel memory management issue in the Linux i3c subsystem. It may indirectly impact systems handling sensitive data if exploited to cause denial-of-service or memory corruption, but no evidence suggests direct regulatory compliance impact.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If an update is not immediately available, consider disabling the I3C subsystem if not in use or restricting access to affected systems until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93283. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart