CVE-2026-80952

In the Linux kernel, the following vulnerability has been resolved:

i3c: master: Fix info leak and UAF in device unregister path

i3c master unregister i3c devs() clears i3cdev->dev->desc before calling device unregister(). During device unregister(), device del() emits a KOBJ REMOVE uevent and unbinds the driver while the device descriptor is still expected to be valid. As a result, i3c device uevent() and a racing modalias show() can observe a NULL desc and fall back to an uninitialized stack struct i3c device info, leaking kernel stack contents in the generated modalias. Driver .remove() callbacks may also encounter an unexpected NULL desc during unbind.

Keep desc valid until device unregister() has completed. Since device unregister() drops the device reference and may free the device, take an extra reference with get device() before unregistering. Clear desc afterwards and release the extra reference with put device(). This preserves the release-time invariant that desc must be NULL while avoiding both the information leak and a potential use-after-free from writing desc after the device has been released.