CVE-2026-80952

Status: UPDATED  |  Advisory ID: CVE-2026-80952

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

i3c: master: Fix info leak and UAF in device unregister path

i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before

calling device_unregister(). During device_unregister(),

device_del() emits a KOBJ_REMOVE uevent and unbinds the driver while

the device descriptor is still expected to be valid. As a result,

i3c_device_uevent() and a racing modalias_show() can observe a NULL

desc and fall back to an uninitialized stack struct i3c_device_info,

leaking kernel stack contents in the generated modalias. Driver

.remove() callbacks may also encounter an unexpected NULL desc during

unbind.

Keep desc valid until device_unregister() has completed. Since

device_unregister() drops the device reference and may free the device,

take an extra reference with get_device() before unregistering. Clear

desc afterwards and release the extra reference with put_device().

This preserves the release-time invariant that desc must be NULL while

avoiding both the information leak and a potential use-after-free from

writing desc after the device has been released. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References