Executive brief
The Linux kernel's i3c (Inter-Integrated Circuit) master driver contains a race condition during device unregistration that leaks kernel memory and can cause crashes. When I3C devices are removed from the system, a critical data structure is cleared too early, allowing other kernel code to read uninitialized memory and use freed memory, potentially exposing sensitive kernel information or causing system instability.
Technical details
The vulnerability is a use-after-free (UAF) and information leak in the i3c master device unregister path (i3c_master_unregister_i3c_devs()). The root cause is that the device descriptor (desc) is cleared before device_unregister() completes. During device_unregister(), the kernel emits a KOBJ_REMOVE uevent and unbinds drivers while the descriptor is expected to remain valid. This race allows i3c_device_uevent() and modalias_show() to observe NULL desc and fall back to an uninitialized stack struct, leaking kernel stack contents. Driver .remove() callbacks may also encounter unexpected NULL desc. The fix delays clearing desc until after device_unregister() completes and uses get_device()/put_device() to maintain proper reference counting, ensuring the descriptor remains valid during the critical window. The patch is available in stable kernel versions.
Affected products
- Linux Linux kernel 3.0 and later (affected in i3c master driver introduced in commit 3a379bbcea0a)
Timeline
- 2026-09-11: disclosed: Published in NVD
- 2026-07-23: patched: Upstream patch authored by Adrian Hunter
- 2026-09-14: patched: Committed to stable kernel trees