CVE-2026-80952: i3c: master: Fix info leak and UAF in device unregister path

CVE-2026-80952: i3c: master: Fix info leak and UAF in device unregister path

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

i3c: master: Fix info leak and UAF in device unregister path

i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before
calling device_unregister().  During device_unregister(),
device_del() emits a KOBJ_REMOVE uevent and unbinds the driver while
the device descriptor is still expected to be valid.  As a result,
i3c_device_uevent() and a racing modalias_show() can observe a NULL
desc and fall back to an uninitialized stack struct i3c_device_info,
leaking kernel stack contents in the generated modalias.  Driver
.remove() callbacks may also encounter an unexpected NULL desc during
unbind.

Keep desc valid until device_unregister() has completed.  Since
device_unregister() drops the device reference and may free the device,
take an extra reference with get_device() before unregistering.  Clear
desc afterwards and release the extra reference with put_device().
This preserves the release-time invariant that desc must be NULL while
avoiding both the information leak and a potential use-after-free from
writing desc after the device has been released.

The Linux kernel CVE team has assigned CVE-2026-80952 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.0 with commit 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 and fixed in 6.12.109 with commit c16b6f25e0cc2dd1055dde1256cbf5a9e888cf49
	Issue introduced in 5.0 with commit 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 and fixed in 6.18.50 with commit 94fb9786d67a8f8b899e77381620f86bad94fdf7
	Issue introduced in 5.0 with commit 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 and fixed in 7.2.4 with commit 4837be0f9ac2efe5e83b35a696b6242c473d280c
	Issue introduced in 5.0 with commit 3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0 and fixed in 7.3-rc1 with commit d2c743efd2d1ee64e94324664808f623dd865872

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80952
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/i3c/master.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c16b6f25e0cc2dd1055dde1256cbf5a9e888cf49
	https://git.kernel.org/stable/c/94fb9786d67a8f8b899e77381620f86bad94fdf7
	https://git.kernel.org/stable/c/4837be0f9ac2efe5e83b35a696b6242c473d280c
	https://git.kernel.org/stable/c/d2c743efd2d1ee64e94324664808f623dd865872