{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-93202", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T16:02:15.092Z", "datePublished": "2026-09-17T16:12:23.071Z", "dateUpdated": "2026-10-30T12:36:23.762Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:36:23.762Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: Fix recursive locking during device registration\n\ni3c_master_register_new_i3c_devs() registers newly discovered devices\nwhile holding i3c_bus_normaluse_lock(), a down_read(). device_register()\ncan immediately probe the device, and probe callbacks typically invoke\nI3C helpers that take i3c_bus_normaluse_lock() again, leading to a\nrecursive acquisition of the same rwsem. rwsems do not support recursive\nread locking and can deadlock when a writer is waiting. See the\n\"Recursive read locks\" section of Documentation/locking/lockdep-design.rst.\n\nFor example, with Intel LPSS I3C, LOCKDEP generates a WARNING like:\n # echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/unbind\n # echo intel-lpss-i3c.0 > /sys/bus/platform/drivers/mipi-i3c-hci/bind\n WARNING: possible recursive locking detected\n kworker/5:1/94 is trying to acquire lock:\n ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_device_match_id+0x45/0x370\n but task is already holding lock:\n ffff88811c810d78 (&i3cbus->lock){++++}-{4:4}, at: i3c_master_reg_work_fn+0x21/0x5f0\n\nFix this by separating device creation from device registration.\nPopulate desc->dev under the maintenance lock, collect the devices that\nstill need registration into a local list, then release the lock before\ncalling device_register(). Finally retake the lock and clean up any\ndevices that failed to register.\n\nUse the maintenance lock rather than the normal-use lock while adding\ndevice objects. A write-side maintenance lock prevents readers from\nobserving a partially initialized desc->dev during initial device\npopulation, or desc->dev disappearing if registration fails.\n\nThe local list requires a list node, so add a list node member to struct\ni3c_device." } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/i3c/master.c", "include/linux/i3c/master.h" ], "versions": [ { "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "015fcf330c29803bbf92b719b4889ba74ecbbc71", "status": "affected", "versionType": "git" }, { "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "6640f778aa3d430e67171f8d17fe4a35bb44b578", "status": "affected", "versionType": "git" }, { "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "0200dc55e68cc0177b6e60919de415cc96fdd4e1", "status": "affected", "versionType": "git" }, { "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "b25232f66e8cd653d0c6bfdbe534e62a2f9d6a1b", "status": "affected", "versionType": "git" }, { "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "9dc73c51ed3ee965c3ddb0ac31cf5c3eea68fa0c", "status": "affected", "versionType": "git" }, { "version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0", "lessThan": "456f832e5fc26fbfd3b8200fd4553eee520cc377", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/i3c/master.c", "include/linux/i3c/master.h" ], "versions": [ { "version": "5.0", "status": "affected" }, { "version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.191" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.160" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.114" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.18.52" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.2.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/015fcf330c29803bbf92b719b4889ba74ecbbc71" }, { "url": "https://git.kernel.org/stable/c/6640f778aa3d430e67171f8d17fe4a35bb44b578" }, { "url": "https://git.kernel.org/stable/c/0200dc55e68cc0177b6e60919de415cc96fdd4e1" }, { "url": "https://git.kernel.org/stable/c/b25232f66e8cd653d0c6bfdbe534e62a2f9d6a1b" }, { "url": "https://git.kernel.org/stable/c/9dc73c51ed3ee965c3ddb0ac31cf5c3eea68fa0c" }, { "url": "https://git.kernel.org/stable/c/456f832e5fc26fbfd3b8200fd4553eee520cc377" } ], "title": "i3c: master: Fix recursive locking during device registration", "x_generator": { "engine": "bippy-1.2.0" } } } }