rootpwn

high · CVSS v3 7.1

CVE-2026-93199

A bug in the Linux kernel’s I3C master driver caused the controller itself to be mistakenly identified as a duplicate target device when sea

Overview

A bug in the Linux kernel’s I3C master driver caused the controller itself to be mistakenly identified as a duplicate target device when searching for devices with the same PID. This misidentification can lead to incorrect bus configuration or device handling, potentially disrupting I3C communications.

Description

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Do not treat master device as a duplicate target i3c_master_search_i3c_dev_duplicate() searches the bus for another I3C device with the same PID as the reference device. The search can match master->this, causing the controller itself to be returned as a duplicate. Since the controller is not a target device, it cannot be a duplicate of one. Exclude master->this from matching so that the function only returns real duplicate target devices.

Impact

The flaw may cause the I3C controller to be treated as a duplicate target, leading to misrouting or dropping of I3C traffic. This primarily affects the availability and integrity of I3C devices on the bus, potentially causing device malfunction or denial of service to dependent services.

Remediation

Apply the kernel patch that excludes the master device from the duplicate‑search logic. Update to the latest kernel release that contains the fix, or rebuild your custom kernel with the corrected i3c driver. Verify that the I3C driver version is at least the one that includes the patch. Monitor system logs for I3C duplicate‑device errors and ensure no stale PID entries remain.

Risk context

The CVSS v3 score of 7.1 classifies this as high severity. While the issue does not provide remote code execution, it can disrupt I3C device operation on systems with the affected kernel. Prompt patching is recommended, especially for embedded or critical systems that rely on I3C communication.

Affected products

  • Linux kernel (i3c driver)
  • Linux distributions with I3C support
  • Embedded Linux devices using I3C bus
  • Raspberry Pi OS
  • Ubuntu Server
  • Debian
  • Fedora
  • CentOS

Scores

Severity
high
CVSS v2
7.2
CVSS v3
7.1
CVSS v4
—
EPSS
—

i3c kernel device-driver duplicate-device bus denial-of-service patch high-severity

← All CVEs

Related CVEs

high

CVE-2026-93203

A race condition in the batman-adv kernel module can corrupt the CRC used to validate claim frames, leading to incorrect routing information in mesh networks. The flaw may cause routing tables to become inconsistent, potentially disrupting network connectivity.

View analysis

high

CVE-2026-93156

In the Linux kernel, the following vulnerability has been resolved: crypto: rk3288 - fail ahash requests on HASH idle timeout rk_hash_run() waits for RK_CRYPTO_HASH_STS to become idle after the final DMA transfer, but ignores the poll result. If the hash engine never becomes idle, the driver still reads the digest registers and finalizes the request with the previous success value. Store the poll result and finalize the request with the timeout error before reading the digest registers.

View analysis

high

CVE-2026-93161

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - clear AES key schedule from stack qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame. Clear the temporary crypto_aes_ctx with memzero_explicit() after the copy.

View analysis

high

CVE-2026-93162

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - cancel work on re-enable SR-IOV timeout The QAT reset worker queues SR-IOV reenable work using a work_struct and completion embedded in an on-stack adf_sriov_dev_data. If the completion wait times out, the reset worker can return while device_sriov_wq still holds or executes the stack-backed work item. Cancel the work on the device_sriov_wq on timeout before the stack frame unwinds.

View analysis