Cloudanix VulnDB

CVE-2026-93200

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing error in the Linux kernel can let a program read memory that has already been freed when certain hardware controllers are added or removed, which may cause crashes.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Sysfs callbacks for an I3C master controller dereference a pointer that has already been freed during device detach, resulting in a use-after-free.

Why it matters to the business

Systems running affected kernel versions risk crashes or potential code execution when I3C master devices are attached or detached; low exploitability and absence from known campaigns reduce immediate operational risk.

How an attack unfolds

An attacker with local access triggers repeated attach/detach operations on an I3C master device so that a freed pointer is dereferenced via sysfs reads or writes before the final device release occurs.

How to fix it

Apply the upstream fix that moves the free of master->this into i3c_masterdev_release() and clears the pointer on the error path in i3c_master_set_info(); rebuild and deploy the patched kernel.

How to confirm the fix worked

Confirm the patch is present by inspecting the i3c master release and detach functions for the updated lifetime of master->this; test by exercising I3C attach/detach while monitoring sysfs callbacks for faults.

Typical attack path

  1. Obtain local access on a system exposing I3C master sysfs entries
  2. Trigger device attach and detach sequences that invoke i3c_master_detach_free_devs()
  3. Perform concurrent or subsequent sysfs accesses that dereference the now-freed master->this pointer

How to detect it

Search kernel logs and crash dumps for use-after-free signatures involving i3c master structures or sysfs callbacks during device detach sequences.

What your security team should do

  • Prioritize kernel updates on systems that expose I3C controllers
  • Monitor kernel oops and use-after-free reports in logs for I3C-related paths
  • Apply the fix within normal patch windows given low EPSS and lack of KEV listing

The record

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix use-after-free of master->this sysfs attribute callbacks for the master controller device dereference master->this. However, master->this is freed in i3c_master_detach_free_devs() before the master device itself is released. As a result, sysfs accesses can dereference a freed master->this pointer, leading to a use-after-free. Keep master->this alive until i3c_masterdev_release(), which is called after the master device and its sysfs state are being torn down. Do not free master->this as part of the normal device detach path. On the error path in i3c_master_set_info(), reset master->this and bus.cur_master to NULL before freeing the allocated device.

Affected packages

Ecosystem Package Introduced Fixed