CVE-2023-52763

What it actually does

Use-after-free in the Linux kernel i3c master driver where DAT_data is accessed before DAT init or after cleanup in i3c_master_bus_init failure paths, resulting in NULL dereference and kernel panic.

Why it matters to the business

Kernel crashes on affected Linux systems can interrupt services, cause downtime, and require reboots; low exploitation likelihood reduces immediate risk but kernel-level impact affects stability across servers and embedded devices.

How an attack unfolds

An attacker triggers the i3c_master_bus_init sequence that attaches I2C devices before DAT initialization or forces a failure path so cleanup frees DAT_data before device detach; subsequent access to the freed or uninitialized DAT_data causes the panic. Android kernel contexts may be targeted by remote code execution attempts.

How to fix it

Update the Linux kernel to commit 39c71357e68e2f03766f9321b9f4882e49ff1442 or later stable releases containing the fix; rebuild and deploy the patched kernel image.

How to confirm the fix worked

Verify the running kernel contains commit 39c71357e68e2f03766f9321b9f4882e49ff1442 via git log or version string; test I3C bus initialization and failure paths to confirm no panic occurs.

Typical attack path

1. Identify systems running vulnerable Linux kernel with i3c master support
2. Trigger I3C bus initialization that attaches I2C devices before DAT allocation
3. Force or wait for i3c_master_bus_init failure to execute premature DAT cleanup
4. Access the NULL DAT_data pointer to induce kernel panic

How to detect it

Review kernel logs for panic messages referencing i3c_master_bus_init, DAT alloc_entry, free_entry, or NULL pointer dereference during I3C bus initialization; correlate with boot or device attach events.

• i3c_master_bus_init
• DAT_data
• alloc_entry
• free_entry

What your security team should do

• Apply the kernel patch containing commit 39c71357e68e2f03766f9321b9f4882e49ff1442 on all affected systems within standard maintenance windows
• Monitor EPSS and KEV status for any future increase in exploitation activity
• Include the fixed kernel in next scheduled image or distribution updates