The Linux kernel's i2c core had a race condition vulnerability (CVE-2026-53400) related to adapter registration. The function i2c_get_adapter() looks up adapters by their ID and takes a reference to the embedded struct device. If the adapter and its struct device are not fully initialized before being added to the IDR, it can lead to accessing uninitialized data, causing NULL-pointer dereferences or use-after-free errors. The i2c-dev chardev, which registers from a bus notifier, uses i2c_get_adapter(), so the fix ensures the adapter is added to the IDR only after full initialization.

This vulnerability can cause serious memory safety issues such as NULL-pointer dereferences and use-after-free conditions in the Linux kernel's i2c subsystem. These issues can lead to system crashes or potentially allow escalation of privileges or denial of service. The CVSS score of 7.8 indicates a high impact on confidentiality, integrity, and availability with low attack complexity and requiring low privileges but local access.

A fix has been implemented in the Linux kernel to ensure that the adapter and its embedded struct device are fully initialized before being added to the IDR. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. No additional mitigations are indicated.