Executive brief
The Linux kernel's i3c master controller driver had a memory safety bug where sysfs attribute handlers could access a freed pointer. When a master controller device was being shut down, the device descriptor was freed prematurely, but sysfs callbacks continued to reference it during device teardown. This could cause system crashes or unpredictable behavior when interacting with i3c controller attributes.
Technical details
The vulnerability is a use-after-free in the i3c master controller driver (drivers/i3c/master.c). The root cause is that sysfs attribute callbacks dereference master->this, a device descriptor that was being freed in i3c_master_detach_free_devs() before the master device itself was released. Sysfs attribute access during device shutdown can dereference the freed pointer. The fix defers freeing of master->this until i3c_masterdev_release(), which is called after sysfs teardown is complete. Additionally, on the error path in i3c_master_set_info(), the pointers are reset to NULL before freeing. Local access to sysfs attributes is required to trigger the vulnerability; no remote or privilege escalation is involved.
Affected products
- Linux Linux Kernel affected versions include 2.6.x through 6.x and later (from 3a379bbcea0a onwards)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched