In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter deregistration race Adapters can be looked up by their id… (CVE-2026-64279)
Source GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWhat to do
AI-suggested
A fix for this vulnerability has been implemented in the Linux kernel by removing the adapter from the IDR before teardown during deregistration and registration failure. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation status and apply updates accordingly.
Description
A race condition vulnerability in the Linux kernel's i2c core was resolved by fixing the adapter deregistration process. The issue involved adapters being looked up by their ID while their resources could be freed concurrently, leading to potential use-after-free conditions. The fix ensures the adapter is removed from the IDR before teardown to prevent access to freed resources.
Impact
Successful exploitation could lead to use-after-free conditions, potentially resulting in system crashes, data corruption, or privilege escalation due to improper handling of freed adapter resources. The CVSS score of 7.8 (high) reflects the potential for significant confidentiality, integrity, and availability impact.
Summary
The vulnerability (CVE-2026-64279) in the Linux kernel i2c core arises from a race condition during adapter deregistration. The function i2c_get_adapter() can look up adapters by their ID and take a reference to the embedded struct device. However, if the adapter is deregistered or registration fails, its resources could be accessed after being freed, such as the device name. The patch removes the adapter from the IDR before teardown to prevent such use-after-free access.
Weaknesses
References
- nvd.nist.gov/vuln/detail/CVE-2026-64279 (opens in a new tab)
- git.kernel.org/stable/c/11dfa37bf544cc806f21742ca2fd2d841bd7032e (opens in a new tab)
- git.kernel.org/stable/c/35dbd1f1f603401155cbd3a180bb18e3a3b675b8 (opens in a new tab)
- git.kernel.org/stable/c/9882a9bd74db08e7bae5821a7050627ae92d3380 (opens in a new tab)
- git.kernel.org/stable/c/b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f (opens in a new tab)
- git.kernel.org/stable/c/b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3 (opens in a new tab)
- git.kernel.org/stable/c/bb234487a447a99315add1b46aa57b72e163e1eb (opens in a new tab)
- git.kernel.org/stable/c/d39282f552dd6c35b9b84b4af78f1198c24f3373 (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-019113.html (opens in a new tab)