CVE-2026-80952

A flaw in the Linux kernel's I3C subsystem causes i3c_master_unregister_i3c_devs() to clear the device descriptor (desc) before device_unregister() completes, so KOBJ_REMOVE uevent handling, modalias_show(), and driver .remove() callbacks can observe a NULL desc and fall back to an uninitialized stack struct i3c_device_info. This leaks kernel stack memory contents through the generated modalias string, and writing desc after the device reference is dropped can also trigger a use-after-free. Exploitation requires local access with some privileges on the machine (CVSS 7.8, AV:L/PR:L), and an attacker could gain disclosure of sensitive kernel memory plus potential memory corruption affecting confidentiality, integrity, and availability. Only systems whose kernels enable the I3C master driver and have actual I3C controller hardware are exposed, which is a small subset of embedded devices rather than typical servers or desktops. No public proof of concept is known and the issue is not on the CISA KEV list.

What to do: Apply your distribution's kernel update once it carries the fix (the patch holds desc valid across device_unregister() using get_device()/put_device()). Verify whether your fleet uses I3C hardware (CONFIG_I3C and i3c-master drivers in use) to prioritize patching; systems without I3C controllers are not practically exposed. No workaround beyond patching is indicated, but the local-privilege prerequisite means standard least-privilege controls limit near-term risk.