CVE-2026-93283

In the Linux kernel, the following vulnerability has been resolved:

i3c: master: Fix device register() error path

When device register() fails in i3c master register new i3c devs(), put device() is called to drop the reference taken by device register(). That drops the last reference, so the device's release callback i3c device release() runs and frees the i3c device.

Two problems follow from that:

i3c device release() does WARN ON(i3cdev->desc), so it warns because desc->dev->desc still points back at the descriptor. Clear it before calling put device().

After put device() frees the i3c device, desc->dev is left pointing at freed memory, so clear desc->dev as well. That prevents, for example, i3c master unregister i3c devs() seeing desc->dev as non-NULL and dereferencing it.