{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80952", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.804Z", "datePublished": "2026-09-11T19:42:21.868Z", "dateUpdated": "2026-09-11T19:42:21.868Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:42:21.868Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: Fix info leak and UAF in device unregister path\n\ni3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before\ncalling device_unregister(). During device_unregister(),\ndevice_del() emits a KOBJ_REMOVE uevent and unbinds the driver while\nthe device descriptor is still expected to be valid. As a result,\ni3c_device_uevent() and a racing modalias_show() can observe a NULL\ndesc and fall back to an uninitialized stack struct i3c_device_info,\nleaking kernel stack contents in the generated modalias. Driver\n.remove() callbacks may also encounter an unexpected NULL desc during\nunbind.\n\nKeep desc valid until device_unregister() has completed. Since\ndevice_unregister() drops the device reference and may free the device,\ntake an extra reference with get_device() before unregistering. Clear\ndesc afterwards and release the extra reference with put_device().\nThis preserves the release-time invariant that desc must be NULL while\navoiding both the information leak and a potential use-after-free from\nwriting desc after the device has been released."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i3c/master.c"], "versions": [{"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "c16b6f25e0cc2dd1055dde1256cbf5a9e888cf49", "status": "affected", "versionType": "git"}, {"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "94fb9786d67a8f8b899e77381620f86bad94fdf7", "status": "affected", "versionType": "git"}, {"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "4837be0f9ac2efe5e83b35a696b6242c473d280c", "status": "affected", "versionType": "git"}, {"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "d2c743efd2d1ee64e94324664808f623dd865872", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i3c/master.c"], "versions": [{"version": "5.0", "status": "affected"}, {"version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c16b6f25e0cc2dd1055dde1256cbf5a9e888cf49"}, {"url": "https://git.kernel.org/stable/c/94fb9786d67a8f8b899e77381620f86bad94fdf7"}, {"url": "https://git.kernel.org/stable/c/4837be0f9ac2efe5e83b35a696b6242c473d280c"}, {"url": "https://git.kernel.org/stable/c/d2c743efd2d1ee64e94324664808f623dd865872"}], "title": "i3c: master: Fix info leak and UAF in device unregister path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/i3c/master.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c16b6f25e0cc2dd1055dde1256cbf5a9e888cf49", "status": "affected", "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "versionType": "git"}, {"lessThan": "94fb9786d67a8f8b899e77381620f86bad94fdf7", "status": "affected", "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "versionType": "git"}, {"lessThan": "4837be0f9ac2efe5e83b35a696b6242c473d280c", "status": "affected", "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "versionType": "git"}, {"lessThan": "d2c743efd2d1ee64e94324664808f623dd865872", "status": "affected", "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/i3c/master.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: Fix info leak and UAF in device unregister path\n\ni3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before\ncalling device_unregister(). During device_unregister(),\ndevice_del() emits a KOBJ_REMOVE uevent and unbinds the driver while\nthe device descriptor is still expected to be valid. As a result,\ni3c_device_uevent() and a racing modalias_show() can observe a NULL\ndesc and fall back to an uninitialized stack struct i3c_device_info,\nleaking kernel stack contents in the generated modalias. Driver\n.remove() callbacks may also encounter an unexpected NULL desc during\nunbind.\n\nKeep desc valid until device_unregister() has completed. Since\ndevice_unregister() drops the device reference and may free the device,\ntake an extra reference with get_device() before unregistering. Clear\ndesc afterwards and release the extra reference with put_device().\nThis preserves the release-time invariant that desc must be NULL while\navoiding both the information leak and a potential use-after-free from\nwriting desc after the device has been released."}], "id": "CVE-2026-80952", "lastModified": "2026-09-11T20:19:00.927", "metrics": {}, "published": "2026-09-11T20:19:00.927", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4837be0f9ac2efe5e83b35a696b6242c473d280c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/94fb9786d67a8f8b899e77381620f86bad94fdf7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c16b6f25e0cc2dd1055dde1256cbf5a9e888cf49"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d2c743efd2d1ee64e94324664808f623dd865872"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Information leak and Use-After-Free in i3c master device unregistration", "id": "2532061", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532061"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["A flaw was found in the Linux kernel's i3c master component. During device unregistration, a race condition can occur where the device descriptor is prematurely cleared. This can lead to an information leak, exposing kernel stack contents in the generated modalias. Additionally, this flaw could result in a potential use-after-free vulnerability, which might allow an attacker to execute arbitrary code or cause a denial of service."], "name": "CVE-2026-80952", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-11T19:42:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80952\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80952\nhttps://git.kernel.org/stable/c/4837be0f9ac2efe5e83b35a696b6242c473d280c\nhttps://git.kernel.org/stable/c/94fb9786d67a8f8b899e77381620f86bad94fdf7\nhttps://git.kernel.org/stable/c/c16b6f25e0cc2dd1055dde1256cbf5a9e888cf49\nhttps://git.kernel.org/stable/c/d2c743efd2d1ee64e94324664808f623dd865872"], "threat_severity": "Moderate"}

{}