CVE-2026-93283

CVE CVE-2026-93283EUVD EUVD-2026-86155Published 2026-09-24T15:52:26.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix device_register() error path When device_register() fails in i3c_master_register_new_i3c_devs(), put_device() is called to drop the reference taken by device_register(). That drops the last reference, so the device's release callback i3c_device_release() runs and frees the i3c_device. Two problems follow from that: i3c_device_release() does WARN_ON(i3cdev->desc), so it warns because desc->dev->desc still points back at the descriptor. Clear it before calling put_device(). After put_device() frees the i3c_device, desc->dev is left pointing at freed memory, so clear desc->dev as well. That prevents, for example, i3c_master_unregister_i3c_devs() seeing desc->dev as non-NULL and dereferencing it.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux cab63f64887616e3c4e31cfd8103320be6ebc8d3 <7f8e2c4f3704d9774bb26b49b1ad6a60ae57d4a0; 204beeb509d37669de34560e83bb8abffe7ee63a; patch: 6.18.52; d48fe8d98171e0fffdeaa8b37ce0a6444bff819b <20a2b6df91fd782ef2ff551febef594d0b46a9a7; 5.10.201 <5.10.270; patch: 5.15.221; patch: 7.3-rc1; 5.4.261 <5.5; patch: 7.2.6; patch: 5.10.270; 6.1.63 <6.1.188; 5.15.139 <5.15.221; 174ae0a3b89e7804e4ea3d31bd83d6e43f39568c <a14dbdf471001dd0601b0c491184990c178a199c; patch: 6.1.188; cab63f64887616e3c4e31cfd8103320be6ebc8d3 <6ecf17bf5fe8da51a6e3fc9e03a76898fcc5c6cf; 6.5.12 <6.6; 1832ed55df45f4145335ad992fb83813cdc58b5d <5bf498623f8397d45f85f14cd631c5e5a565c2fb; patch: 0; patch: 6.6.157; cab63f64887616e3c4e31cfd8103320be6ebc8d3 <74be657d98a8d684c0475f3cbd450ef2a30ffc73; 6.6.2 <6.6.157; 6.7; b24cf43d9babf1265a2bb0ae8d198267cef43b83; e49a51a96b531f1b4bcd8d358e645b6c74ef67e6 <d22ad96f1a0c89e0ba66a2facc7430f0923919e3; cab63f64887616e3c4e31cfd8103320be6ebc8d3 <7ef12e1dd06e442eebf370f6e53c41bd056d0f22; patch: 6.12.110

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.