CVE-2026-80952: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80952 Overview

CVE-2026-80952 is a Linux kernel vulnerability in the Improved Inter-Integrated Circuit (i3c) master driver subsystem. The flaw resides in the device unregister path, where i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before calling device_unregister(). This ordering creates a window in which concurrent code paths observe a NULL descriptor and fall back to an uninitialized stack structure, leaking kernel stack memory and enabling a use-after-free condition.

Critical Impact
A local, low-privileged attacker can leak kernel stack contents through the sysfs modalias interface and trigger a use-after-free in the i3c device unregister path, potentially leading to privilege escalation.

Affected Products

Linux kernel versions containing the vulnerable i3c master driver in drivers/i3c/master.c
Distributions shipping kernels prior to the fixes referenced in the upstream stable commits
Systems with i3c host controllers exposing devices through the i3c subsystem

Discovery Timeline

2026-09-11 - CVE-2026-80952 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80952

Vulnerability Analysis

The vulnerability combines two distinct weaknesses in the same code path: an information disclosure through uninitialized stack memory and a use-after-free on the device descriptor. Both stem from incorrect ordering of operations during i3c device teardown.

When i3c_master_unregister_i3c_devs() clears the desc pointer prior to invoking device_unregister(), the kernel then calls device_del(). That function emits a KOBJ_REMOVE uevent and unbinds the driver while the device descriptor is still expected to be valid. A racing modalias_show() handler or the i3c_device_uevent() callback observes desc == NULL and falls back to an uninitialized stack struct i3c_device_info. The uninitialized fields are then serialized into the generated modalias string, disclosing kernel stack contents to userspace.

Driver .remove() callbacks executed during unbind may also encounter the unexpected NULL descriptor, producing undefined behavior or a potential use-after-free when the device reference is dropped and the descriptor is written after the underlying device has been released.

Root Cause

The root cause is a release-time invariant violation. The i3c subsystem requires that desc remain valid until device_unregister() completes, but the pre-fix code cleared desc too early. Combined with the reference-count semantics of device_unregister(), which drops the device reference and may free the underlying struct device, writing to desc after unregistration risks touching freed memory.

Attack Vector

Exploitation requires local access with the ability to read sysfs attributes such as /sys/bus/i3c/devices/*/modalias or receive uevents from the i3c subsystem during device removal. An attacker races i3c device unregistration with reads of the modalias attribute to capture leaked kernel stack bytes. The disclosed memory can undermine kernel address space layout randomization (KASLR) and expose sensitive data used to chain further exploitation of the concurrent use-after-free window.

No verified public exploit code is available for this issue. Refer to the upstream commits referenced below for the exact code paths involved.

Detection Methods for CVE-2026-80952

Indicators of Compromise

Unexpected kernel warnings, NULL pointer traces, or KASAN reports referencing i3c_device_uevent, modalias_show, or i3c_master_unregister_i3c_devs in dmesg.
Anomalous or malformed modalias values read from /sys/bus/i3c/devices/*/modalias containing non-ASCII or high-entropy bytes.
Unprivileged processes repeatedly reading i3c sysfs attributes while devices are being hot-unplugged or the driver is being unloaded.

Detection Strategies

Enable KASAN and KMSAN on test kernels to surface use-after-free writes and uninitialized memory reads in the i3c unregister path.
Audit installed kernel packages against distribution advisories that reference the upstream fix commits (c64daaab, d2c743e, ef72ff66, 4837be0, 94fb978, c16b6f2, 1099951, 334cfb5).
Instrument kernel tracepoints on device_unregister and i3c driver bind/unbind operations to identify races correlated with sysfs reads.

Monitoring Recommendations

Monitor kernel log ingestion for oops, WARN_ON, or KASAN traces mentioning i3c symbols and forward them to a centralized log platform.
Track process access to /sys/bus/i3c/ attributes and alert on non-administrative processes reading these paths.
Baseline kernel versions across the fleet and flag hosts running unpatched kernels that expose i3c host controllers.

How to Mitigate CVE-2026-80952

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the Kernel Commit c64daaab and companion stable backports.
Update to distribution kernel packages that incorporate the fix and reboot affected hosts.
Prioritize patching on systems that expose i3c host controllers, including embedded and edge devices.

Patch Information

The fix retains desc validity until device_unregister() completes. It takes an extra reference with get_device() before unregistering, clears desc afterward, and releases the reference with put_device(). This preserves the release-time invariant while eliminating both the stack information leak and the use-after-free. The relevant stable commits are: Kernel Commit 1099951, Kernel Commit 334cfb5, Kernel Commit 4837be0, Kernel Commit 94fb978, Kernel Commit c16b6f2, Kernel Commit c64daaab, Kernel Commit d2c743e, and Kernel Commit ef72ff66.

Workarounds

Restrict local user access on affected systems and remove untrusted users from hosts that expose i3c devices until the kernel is patched.
If i3c hardware is not in use, unload the i3c and i3c-master kernel modules and blacklist them to eliminate the attack surface.
Tighten sysfs permissions where feasible to prevent unprivileged reads of i3c device attributes.

bash

# Verify kernel version and block the i3c modules if not required
uname -r
lsmod | grep -E 'i3c'
echo 'blacklist i3c' | sudo tee /etc/modprobe.d/blacklist-i3c.conf
echo 'blacklist i3c-master' | sudo tee -a /etc/modprobe.d/blacklist-i3c.conf
sudo depmod -a