CVE-2026-93283
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix device_register() error path When device_register() fails in i3c_master_register_new_i3c_devs(), put_device() is called to drop the reference taken by device_register(). That drops the last reference, so the device's release callback i3c_device_release() runs and frees the i3c_device. Two problems follow from that: i3c_device_release() does WARN_ON(i3cdev->desc), so it warns because desc->dev->desc still points back at the descriptor. Clear it before calling put_device(). After put_device() frees the i3c_device, desc->dev is left pointing at freed memory, so clear desc->dev as well. That prevents, for example, i3c_master_unregister_i3c_devs() seeing desc->dev as non-NULL and dereferencing it.
Affected versions
Linux kernel versions
5.10.201,
5.15.139,
6.1.63,
6.6.2,
5.4.261,
6.5.12,
6.7
and later are affected. Fixed in
5.10.270,
5.15.221,
6.1.188,
6.6.157,
6.12.110,
6.18.52,
7.2.6,
7.3-rc1
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-93283?
CVE-2026-93283 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.10.201 onward and has been patched in 5.10.270, 5.15.221, 6.1.188 and others. CVE-2026-93283 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-93283?
Yes. CVE-2026-93283 has been patched. Fixed versions include 5.10.270, 5.15.221, 6.1.188 and others. If you are running Linux kernel 5.10.201 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-93283 actively exploited?
No. CVE-2026-93283 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.