CVE-2026-93283

A flaw was found in the Linux kernel's I3C (Improved Inter-Integrated Circuit) master subsystem. This issue can result in a Denial of Service (DoS) caused by a system crash. When device registration fails, the driver frees the device object but fails to clear internal pointers referencing the freed memory. A local user could exploit this dangling reference during subsequent device unregistration to trigger a use-after-free condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the I3C subsystem kernel module from loading on systems where I3C hardware is not required:

1. Create a configuration file to disable the module:

echo "install i3c /bin/true" > /etc/modprobe.d/disable-i3c.conf

2. Blacklist the module:

echo "blacklist i3c" >> /etc/modprobe.d/disable-i3c.conf

3. If the module is already loaded, unload it:

modprobe -r i3c

Caveat: Disabling the i3c module prevents the operating system from recognizing and communicating with attached I3C devices and bus controllers. If the module cannot be unloaded because it is in use or built into the active kernel, a system restart is required for these settings to take effect.