CVE-2026-93200 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: Fix use-after-free of master->this
sysfs attribute callbacks for the master controller device dereference master->this. However, master->this is freed in i3c_master_detach_free_devs() before the master device itself is released.
As a result, sysfs accesses can dereference a freed master->this pointer, leading to a use-after-free.
Keep master->this alive until i3c_masterdev_release(), which is called after the master device and its sysfs state are being torn down. Do not free master->this as part of the normal device detach path.
On the error path in i3c_master_set_info(), reset master->this and bus.cur_master to NULL before freeing the allocated device.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's Inter-Integrated Circuit (I2C) Controller driver, specifically within the I3C subsystem, contained a critical memory management flaw related to object lifetime and pointer dereferencing during device detachment operations. The vulnerability centers on the sysfs attribute callbacks associated with the master controller device. These callbacks are designed to expose hardware configuration and status information to user-space applications through the virtual file system interface provided by the kernel. When these attributes are accessed, they internally reference a structure pointed to by the master->this pointer within the I3C master data structures. The core issue arises from an incorrect sequencing of resource deallocation during the device detachment process. Specifically, the function i3c_master_detach_free_devs() was responsible for freeing the memory associated with master->this before the parent master device itself had been fully released and its sysfs entries removed. This creates a race condition or direct access path where user-space interactions via sysfs can trigger code paths that attempt to dereference a pointer to already freed kernel memory, resulting in a use-after-free vulnerability.
From a technical perspective, this flaw represents a classic lifecycle management error where the reference counting and cleanup order of nested objects are not properly synchronized with their exposure points. The master->this structure likely contains critical state information or function pointers that must remain valid for as long as any interface to it exists. By freeing this memory prematurely in the detach path while the sysfs device node remains active, the kernel allows potentially malicious or simply erroneous user-space programs to trigger undefined behavior upon reading specific attributes. This can lead to a variety of negative outcomes including kernel panics due to invalid memory access, data corruption if the freed memory is reallocated and written to by another process before being accessed again, or in worst-case scenarios, arbitrary code execution if an attacker can control the contents of the reclaimed memory region and exploit specific dereference patterns.
The operational impact of this vulnerability extends beyond simple stability issues. A successful exploitation could allow a local user with access to the relevant sysfs entries to crash the system, leading to a denial-of-service condition for all users on that machine. More critically, if the kernel's slab allocator returns the freed memory block to another allocation request before it is accessed again, an attacker might be able to manipulate the contents of master->this. This could potentially lead to privilege escalation or remote code execution depending on what data structures are overwritten and how they are subsequently used by other parts of the I3C subsystem or related kernel modules. The presence of this flaw indicates a lack of strict adherence to object lifetime rules in the driver's teardown logic, which is particularly dangerous given that sysfs interfaces are often accessible to unprivileged users depending on system configuration and permissions.
To mitigate this vulnerability, the fix involves restructuring the cleanup sequence within the I3C master driver code. The primary change ensures that master->this remains allocated until i3c_masterdev_release() is invoked. This release function is called only after the master device itself has been completely torn down and its sysfs state removed, thereby guaranteeing that no further user-space accesses can occur while the memory is still valid. Additionally, the fix addresses error handling paths within i3c_master_set_info(). In scenarios where initialization or configuration fails partway through execution, it is imperative to reset master->this and bus.cur_master pointers to NULL before freeing any allocated device structures. This prevents dangling pointer issues in subsequent operations that might check these fields for validity. By enforcing this strict ordering of deallocation and ensuring nullification on error paths, the kernel maintains memory safety and prevents unauthorized access to freed resources.
This vulnerability is categorized under CWE-416, Use After Free, which describes situations where a program continues to use a pointer after it has been freed, leading to undefined behavior. In terms of attack vectors, this aligns with ATT&CK technique T1059, Command and Scripting Interpreter, if the exploitation leads to further system compromise via local privilege escalation or service disruption. It also relates to CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, although in this specific case, it is more directly a sequential logic error rather than a concurrent race condition between threads, as the sysfs access happens after the detach has been initiated but before completion. Security practitioners should ensure that their Linux systems are updated to include patches for the I3C subsystem master driver to eliminate this risk. Regular auditing of kernel drivers for proper resource management and adherence to lifecycle protocols is essential to prevent similar memory safety violations in other parts of the operating system.