EUVD-2026-76275
GHSA-m64m-jwhp-5878
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition against device unregistration requires AC:H; I:L because UAF write controllability as a memory corruption primitive is unconfirmed from available description.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: Fix info leak and UAF in device unregister path
i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before calling device_unregister(). During device_unregister(), device_del() emits a KOBJ_REMOVE uevent and unbinds the driver while the device descriptor is still expected to be valid. As a result, i3c_device_uevent() and a racing modalias_show() can observe a NULL desc and fall back to an uninitialized stack struct i3c_device_info, leaking kernel stack contents in the generated modalias. Driver .remove() callbacks may also encounter an unexpected NULL desc during unbind.
Keep desc valid until device_unregister() has completed. Since device_unregister() drops the device reference and may free the device, take an extra reference with get_device() before unregistering. Clear desc afterwards and release the extra reference with put_device(). This preserves the release-time invariant that desc must be NULL while avoiding both the information leak and a potential use-after-free from writing desc after the device has been released.
AnalysisAI
Stack information disclosure and use-after-free in the Linux kernel i3c master driver allow a local, low-privileged user to leak kernel stack contents through the sysfs modalias interface during device unregistration. The defect exists from kernel 5.0 onward through 6.12.108, 6.18.49, and 7.2.3: i3cdev->dev->desc is zeroed before device_unregister() completes, so racing calls to i3c_device_uevent() and modalias_show() read a NULL descriptor and fall back to an uninitialized stack struct i3c_device_info, exposing raw kernel stack bytes in the generated uevent string. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local shell access with at least low-privilege credentials (CVSS PR:L); (2) i3c bus hardware must be physically present on the target system and the i3c subsystem must be compiled into the running kernel - systems without i3c devices (the vast majority of x86 server deployments) have no attack surface regardless of kernel version; (3) a timing race must be won between a sysfs read of the device's modalias or uevent attribute and the moment device_unregister() is executing after desc has been zeroed - this is a narrow window requiring concurrent triggering of device unregistration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS of 7.8 (AV:L/AC:L/PR:L) overstates the attack complexity - exploitation relies on a timing race between device unregistration and a concurrent sysfs read, which realistically raises the complexity to AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched stable kernel release: 6.12.109 (commit c16b6f25e0cc2dd1055dde1256cbf5a9e888cf49 at https://git.kernel.org/stable/c/c16b6f25e0cc2dd1055dde1256cbf5a9e888cf49), 6.18.50 (commit 94fb9786d67a at https://git.kernel.org/stable/c/94fb9786d67a8f8b899e77381620f86bad94fdf7), or 7.2.4 (commits 4837be0f9ac2 and d2c743efd2d1 at https://git.kernel.org/stable/c/4837be0f9ac2efe5e83b35a696b6242c473d280c and https://git.kernel.org/stable/c/d2c743efd2d1ee64e94324664808f623dd865872); 7.3-rc1 includes the fix for mainline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems in your infrastructure that use i3c devices and document their current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today