CVE-2026-93202 - Vulnerability Details

Vendors	Products
Linux	Linux Kernel

Link	Providers
https://git.kernel.org/stable/c/015fcf330c29803bbf92b719b4889ba74ecbbc71
https://git.kernel.org/stable/c/0200dc55e68cc0177b6e60919de415cc96fdd4e1
https://git.kernel.org/stable/c/456f832e5fc26fbfd3b8200fd4553eee520cc377
https://git.kernel.org/stable/c/6640f778aa3d430e67171f8d17fe4a35bb44b578
https://git.kernel.org/stable/c/9dc73c51ed3ee965c3ddb0ac31cf5c3eea68fa0c
https://git.kernel.org/stable/c/b25232f66e8cd653d0c6bfdbe534e62a2f9d6a1b

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/015fcf330c29803bbf92b719b4889ba74ecbbc71

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0200dc55e68cc0177b6e60919de415cc96fdd4e1 https://git.kernel.org/stable/c/6640f778aa3d430e67171f8d17fe4a35bb44b578

Type	Values Removed	Values Added
Weaknesses		CWE-1340

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix recursive locking during device registration i3c_master_register_new_i3c_devs() registers newly discovered devices while holding i3c_bus_normaluse_lock(), a down_read(). device_register() can immediately probe the device, and probe callbacks typically invoke I3C helpers that take i3c_bus_normaluse_lock() again, leading to a recursive acquisition of the same rwsem. rwsems do not support recursive read locking and can deadlock when a writer is waiting. See the "Recursive read locks" section of Documentation/locking/lockdep-design.rst. For example, with Intel LPSS I3C, LOCKDEP generates a WARNING like: # echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/unbind # echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/bind WARNING: possible recursive locking detected kworker/5:1/94 is trying to acquire lock: ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_device_match_id+0x45/0x370 but task is already holding lock: ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_master_reg_work_fn+0x21/0x5f0 Fix this by separating device creation from device registration. Populate desc->dev under the maintenance lock, collect the devices that still need registration into a local list, then release the lock before calling device_register(). Finally retake the lock and clean up any devices that failed to register. Use the maintenance lock rather than the normal-use lock while adding device objects. A write-side maintenance lock prevents readers from observing a partially initialized desc->dev during initial device population, or desc->dev disappearing if registration fails. The local list requires a list node, so add a list node member to struct i3c_device.
Title		i3c: master: Fix recursive locking during device registration
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/456f832e5fc26fbfd3b8200fd4553eee520cc377 https://git.kernel.org/stable/c/9dc73c51ed3ee965c3ddb0ac31cf5c3eea68fa0c https://git.kernel.org/stable/c/b25232f66e8cd653d0c6bfdbe534e62a2f9d6a1b

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93202", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T16:02:15.092Z", "datePublished": "2026-09-17T16:12:23.071Z", "dateUpdated": "2026-10-30T12:36:23.762Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:36:23.762Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: Fix recursive locking during device registration\n\ni3c_master_register_new_i3c_devs() registers newly discovered devices\nwhile holding i3c_bus_normaluse_lock(), a down_read(). device_register()\ncan immediately probe the device, and probe callbacks typically invoke\nI3C helpers that take i3c_bus_normaluse_lock() again, leading to a\nrecursive acquisition of the same rwsem. rwsems do not support recursive\nread locking and can deadlock when a writer is waiting. See the\n\"Recursive read locks\" section of Documentation/locking/lockdep-design.rst.\n\nFor example, with Intel LPSS I3C, LOCKDEP generates a WARNING like:\n # echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/unbind\n # echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/bind\n WARNING: possible recursive locking detected\n kworker/5:1/94 is trying to acquire lock:\n ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_device_match_id+0x45/0x370\n but task is already holding lock:\n ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_master_reg_work_fn+0x21/0x5f0\n\nFix this by separating device creation from device registration.\nPopulate desc->dev under the maintenance lock, collect the devices that\nstill need registration into a local list, then release the lock before\ncalling device_register(). Finally retake the lock and clean up any\ndevices that failed to register.\n\nUse the maintenance lock rather than the normal-use lock while adding\ndevice objects. A write-side maintenance lock prevents readers from\nobserving a partially initialized desc->dev during initial device\npopulation, or desc->dev disappearing if registration fails.\n\nThe local list requires a list node, so add a list node member to struct\ni3c_device."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i3c/master.c", "include/linux/i3c/master.h"], "versions": [{"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "015fcf330c29803bbf92b719b4889ba74ecbbc71", "status": "affected", "versionType": "git"}, {"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "6640f778aa3d430e67171f8d17fe4a35bb44b578", "status": "affected", "versionType": "git"}, {"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "0200dc55e68cc0177b6e60919de415cc96fdd4e1", "status": "affected", "versionType": "git"}, {"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "b25232f66e8cd653d0c6bfdbe534e62a2f9d6a1b", "status": "affected", "versionType": "git"}, {"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "9dc73c51ed3ee965c3ddb0ac31cf5c3eea68fa0c", "status": "affected", "versionType": "git"}, {"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "456f832e5fc26fbfd3b8200fd4553eee520cc377", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i3c/master.c", "include/linux/i3c/master.h"], "versions": [{"version": "5.0", "status": "affected"}, {"version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/015fcf330c29803bbf92b719b4889ba74ecbbc71"}, {"url": "https://git.kernel.org/stable/c/6640f778aa3d430e67171f8d17fe4a35bb44b578"}, {"url": "https://git.kernel.org/stable/c/0200dc55e68cc0177b6e60919de415cc96fdd4e1"}, {"url": "https://git.kernel.org/stable/c/b25232f66e8cd653d0c6bfdbe534e62a2f9d6a1b"}, {"url": "https://git.kernel.org/stable/c/9dc73c51ed3ee965c3ddb0ac31cf5c3eea68fa0c"}, {"url": "https://git.kernel.org/stable/c/456f832e5fc26fbfd3b8200fd4553eee520cc377"}], "title": "i3c: master: Fix recursive locking during device registration", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/i3c/master.c", "include/linux/i3c/master.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "015fcf330c29803bbf92b719b4889ba74ecbbc71", "status": "affected", "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "versionType": "git"}, {"lessThan": "6640f778aa3d430e67171f8d17fe4a35bb44b578", "status": "affected", "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "versionType": "git"}, {"lessThan": "0200dc55e68cc0177b6e60919de415cc96fdd4e1", "status": "affected", "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "versionType": "git"}, {"lessThan": "b25232f66e8cd653d0c6bfdbe534e62a2f9d6a1b", "status": "affected", "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "versionType": "git"}, {"lessThan": "9dc73c51ed3ee965c3ddb0ac31cf5c3eea68fa0c", "status": "affected", "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "versionType": "git"}, {"lessThan": "456f832e5fc26fbfd3b8200fd4553eee520cc377", "status": "affected", "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/i3c/master.c", "include/linux/i3c/master.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: Fix recursive locking during device registration\n\ni3c_master_register_new_i3c_devs() registers newly discovered devices\nwhile holding i3c_bus_normaluse_lock(), a down_read(). device_register()\ncan immediately probe the device, and probe callbacks typically invoke\nI3C helpers that take i3c_bus_normaluse_lock() again, leading to a\nrecursive acquisition of the same rwsem. rwsems do not support recursive\nread locking and can deadlock when a writer is waiting. See the\n\"Recursive read locks\" section of Documentation/locking/lockdep-design.rst.\n\nFor example, with Intel LPSS I3C, LOCKDEP generates a WARNING like:\n # echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/unbind\n # echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/bind\n WARNING: possible recursive locking detected\n kworker/5:1/94 is trying to acquire lock:\n ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_device_match_id+0x45/0x370\n but task is already holding lock:\n ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_master_reg_work_fn+0x21/0x5f0\n\nFix this by separating device creation from device registration.\nPopulate desc->dev under the maintenance lock, collect the devices that\nstill need registration into a local list, then release the lock before\ncalling device_register(). Finally retake the lock and clean up any\ndevices that failed to register.\n\nUse the maintenance lock rather than the normal-use lock while adding\ndevice objects. A write-side maintenance lock prevents readers from\nobserving a partially initialized desc->dev during initial device\npopulation, or desc->dev disappearing if registration fails.\n\nThe local list requires a list node, so add a list node member to struct\ni3c_device."}], "id": "CVE-2026-93202", "lastModified": "2026-10-30T13:21:00.240", "metrics": {}, "published": "2026-09-17T17:18:16.510", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/015fcf330c29803bbf92b719b4889ba74ecbbc71"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0200dc55e68cc0177b6e60919de415cc96fdd4e1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/456f832e5fc26fbfd3b8200fd4553eee520cc377"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6640f778aa3d430e67171f8d17fe4a35bb44b578"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9dc73c51ed3ee965c3ddb0ac31cf5c3eea68fa0c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b25232f66e8cd653d0c6bfdbe534e62a2f9d6a1b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

Metrics

Affected Vendors & Products

Metrics

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object