CVE-2026-93200

A flaw was found in the Linux kernel's i3c master driver. This use-after-free vulnerability occurs because sysfs attribute callbacks can attempt to access memory that has already been deallocated. An attacker could potentially exploit this to cause system instability or a denial of service.

A use-after-free can occur in the I3C master controller sysfs path because sysfs attribute callbacks may dereference the master self descriptor after it has already been freed during device detach. A local user can potentially trigger the vulnerable access by reading the exposed sysfs attributes while the controller is being torn down or unbound, causing a stale kernel pointer dereference. For the CVSS the PR:L is used for the paranoid score because local code execution or local sysfs access is needed, but full administrative privileges are not necessarily required for the sysfs read side of the race. The issue is not network reachable and depends on I3C support and a reachable master controller device. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.