In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xe_i2c_notifier() stores the… (CVE-2026-99001)

The vulnerability in the Linux kernel's drm/xe/i2c driver arises from improper handling of work items during device removal. Specifically, xe_i2c_notifier() schedules work on i2c->work when the adapter is registered. However, xe_i2c_remove() unregisters the adapter and client devices without draining or canceling this work. Consequently, a work item may run after the adapter is freed, causing a use-after-free condition. The patch moves bus_unregister_notifier() before client teardown and cancels the work immediately after, ensuring no new work is scheduled and queued work is drained before client structures are freed.

Exploitation of this vulnerability could lead to use-after-free memory access in kernel space, potentially causing system instability, crashes, or escalation of privileges if exploited. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel that reorders the device removal process to unregister the bus notifier before client teardown and cancels queued work items to prevent use-after-free conditions. Users should update to a kernel version that includes this patch once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.