CVE-2026-80952

A flaw was found in the Linux kernel's i3c master component. During device unregistration, a race condition can occur where the device descriptor is prematurely cleared. This can lead to an information leak, exposing kernel stack contents in the generated modalias. Additionally, this flaw could result in a potential use-after-free vulnerability, which might allow an attacker to execute arbitrary code or cause a denial of service.

An information leak in the I3C device unregister path can occur because i3cdev dev desc is cleared before device_unregister() completes. During device_unregister(), KOBJ_REMOVE uevent generation and driver unbind can still call paths such as i3c_device_uevent() or a racing modalias_show(), which expect desc to remain valid. If desc is NULL, the code can fall back to an uninitialized stack i3c_device_info and expose kernel stack bytes through the generated modalias. The same lifetime window can also affect driver remove callbacks and is treated as a potential UAF candidate because the unregister path can drop the device reference while code still reasons about the device descriptor. For the CVSS the PR:L value is used in the paranoid score because a local unprivileged process may be able to observe uevents or race sysfs modalias access on the same system, although reliable triggering of device unregister usually depends on local device or driver control. The issue is not network reachable. Impact is at least local information disclosure and possible denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.