What’s Vulnerable › Vulnerabilities

CVE-2026-93199: i3c: master: Do not treat master device as a duplicate target

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Do not treat master device as a duplicate target i3c_master_search_i3c_dev_duplicate() searches the bus for another I3C device with the same PID as the reference device. The search can match master->this, causing the controller itself to be returned as a duplicate. Since the controller is not a target device, it cannot be a duplicate of one. Exclude master->this from matching so that the function only returns real duplicate target devices.

Affected products

• Linux: 5.0 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/150e71808d3715a0deefbb189c780d03fdbdc735
• https://git.kernel.org/stable/c/3728d90ec66d4ad33d357e7d6e82b02d34e1c99c
• https://git.kernel.org/stable/c/4dc1b3eeba7991905a5b5b8129ebea51be7d87b7
• https://git.kernel.org/stable/c/533faf3d2e67ded0a62b7ba753c0fe993d1dfc26
• https://git.kernel.org/stable/c/6f2340857fc206e7ebfc50c568fb65c3055e568b
• https://git.kernel.org/stable/c/7b25b755d59077dd9484ba1360b8fe6396e5ccfb
• https://git.kernel.org/stable/c/d0cc00957292e353ad46039034cd8f82fc4f8057
• https://git.kernel.org/stable/c/d72a5e9060030a1c205b54157c15a428b741d83f

Get alerted when CVE-2026-93199 or the next vulnerability affects your stack