The Linux kernel i3c master driver performed incorrect reference counting when device_register() failed in i3c_master_register_new_i3c_devs(). The code called put_device() after obtaining a reference to an i3c_device, which freed the device prematurely. Because i3c_device_release() was executed before the reference counters were cleared, pointers to the device's descriptor pointed to freed memory. Subsequent code paths, such as i3c_master_unregister_i3c_devs(), could dereference these dangling pointers, causing a kernel crash or panic. The flaw illustrates memory corruption (CWE-825).

All Linux kernel builds that include the i3c master driver without the update that fixes the reference counting bug. The issue exists in any distribution or kernel release where the unpatched module is loaded, regardless of specific version or vendor.

The CVSS score of 7.0 indicates high severity, while the EPSS score of <1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to trigger the failure case in device_register()—for example by interacting with the i3c interface—before the kernel dereferences the freed object. No remote trigger is documented, so the exploitation path is presumed to be local or require control over the i3c subsystem.