HIGH Introduced in 5.0
i3c DevUnregister Leak
CVE-2026-80952
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before calling device_unregister(). During device_unregister(), device_del() emits a KOBJ_REMOVE uevent and unbinds the driver while the device descriptor is still expected to be valid. As a result, i3c_device_uevent() and a racing modalias_show() can observe a NULL desc and fall back to an uninitialized stack struct i3c_device_info, leaking kernel stack contents in the generated modalias. Driver .remove() callbacks may also encounter an unexpected NULL desc during unbind. Keep desc valid until device_unregister() has completed. Since device_unregister() drops the device reference and may free the device, take an extra reference with get_device() before unregistering. Clear desc afterwards and release the extra reference with put_device(). This preserves the release-time invariant that desc must be NULL while avoiding both the information leak and a potential use-after-free from writing desc after the device has been released.
02KernelScan AI Analysis
Risk summary
A local user on a system with I3C hardware can race a sysfs read against device removal to leak kernel stack contents via the device modalias. The same race may cause a kernel panic if a driver remove callback dereferences the prematurely cleared descriptor. Systems without I3C hardware or without interactive local users are not exposed.
Vulnerability analysis
The I3C master driver clears a device's internal descriptor pointer before unregistering the device from the Linux device model. During the unregister operation, the kernel emits a removal uevent and unbinds the device driver, both of which expect the descriptor to still be valid. When these paths find the descriptor already cleared, they fall back to an uninitialized stack structure to generate the device modalias, leaking kernel stack contents to any local user reading the sysfs attribute at the right moment. Driver removal callbacks may also dereference the unexpectedly NULL descriptor, causing a kernel panic. The fix keeps the descriptor valid for the entire duration of device unregister by taking an extra reference on the device beforehand, clearing the descriptor only after unregister completes, and then releasing the reference. This vulnerability requires I3C hardware to be present and the I3C master driver loaded; the information leak is readable by any local user via sysfs, but triggering the race requires timing a read against an ongoing device removal.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.0 | 5.10.270 | 334cfb5e285c |
| 6.1 | 5.0 | 6.1.188 | c64daaaba08e |
| 6.12 | 5.0 | 6.12.109 | c16b6f25e0cc |
| 6.18 | 5.0 | 6.18.50 | 94fb9786d67a |
| 7.2 | 5.0 | 7.2.4 | 4837be0f9ac2 |
| 5.15 | 5.0 | 5.15.221 | 109995153898 |
| mainline | 5.0 | 7.3-rc1 | d2c743efd2d1 |
| 6.6 | 5.0 | 6.6.157 | ef72ff6650c4 |
| cip/6.12 | 5.0 | 6.12.111-cip32 | c16b6f25e0cc |