The Linux kernel's i3c master device unregister function i3c_master_unregister_i3c_devs() previously cleared the device descriptor before calling device_unregister(). During device_unregister(), device_del() emits a KOBJ_REMOVE uevent and unbinds the driver while the device descriptor is still expected to be valid. This race condition allows i3c_device_uevent() and a racing modalias_show() to observe a NULL descriptor and fall back to an uninitialized stack structure, leaking kernel stack contents in the modalias. Additionally, driver remove callbacks may encounter unexpected NULL descriptors during unbind, causing use-after-free issues. The fix keeps the descriptor valid until device_unregister() completes by taking an extra reference with get_device() before unregistering and releasing it afterward, preventing both information leakage and UAF.

This vulnerability can lead to leakage of kernel stack contents through the generated modalias, potentially exposing sensitive kernel memory information. It also introduces a use-after-free condition during device unregistration, which could cause instability or crashes in kernel drivers handling the i3c devices. There is no indication of known exploits in the wild.

A fix has been implemented that keeps the device descriptor valid until device_unregister() completes by taking an extra device reference before unregistering and clearing the descriptor afterward. Users should update their Linux kernel to a version that includes this fix once available. Since this is a kernel-level vulnerability, applying the official patch or kernel update is the recommended remediation.