CVE-2026-93202 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of the Linux kernel, especially those using the i3c master device, should assess exposure and prioritize verification of affected systems.

Why it matters

A vulnerability in the Linux kernel's i3c master device registration can lead to recursive locking and potential deadlocks, requiring verification of affected systems and application of patches.

• Defenders should verify if their systems are using affected versions of the Linux kernel
• Defenders should review and apply patches to fix the recursive locking issue
• Defenders should monitor system logs for potential deadlock warnings

Technical summary

The Linux kernel's i3c master device registration is vulnerable to recursive locking, potentially leading to deadlocks, due to the i3c_master_register_new_i3c_devs() function registering newly discovered devices while holding the i3c_bus_normaluse_lock(). This can cause issues when a device's probe callback invokes I3C helpers that take i3c_bus_normaluse_lock() again, resulting in a recursive acquisition of the same rwsem. Defenders should assess exposure and prioritize verification of affected systems, especially those using the i3c master device.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those using the i3c master device.

Recommended defensive actions

• Review and apply the provided patches to fix the recursive locking issue
• Verify that affected systems are using the latest Linux kernel version
• Monitor system logs for potential deadlock warnings
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including a description of the issue and references to the relevant commits. Defenders should verify if their systems are using affected versions of the Linux kernel and review system logs for potential deadlock warnings. The i3c_master_register_new_i3c_devs() function registers newly discovered devices while holding the i3c_bus_normaluse_lock(), which can lead to recursive locking and potential deadlocks. Evidence is limited to public CVE details and may not reflect

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.