Executive brief
A race condition in the Linux kernel's I2C subsystem could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when hardware adapters are accessed before they are fully initialized during the registration process. This affects the stability and reliability of systems using I2C devices, such as sensors or controllers.
Technical details
A race condition exists in the Linux kernel I2C core during adapter registration. The function i2c_get_adapter() can look up an adapter by its ID via the IDR (Integer ID Management) before the underlying 'struct device' has been fully initialized. If a process or driver attempts to access the adapter during this window, it may encounter uninitialized data, resulting in a NULL-pointer dereference or a use-after-free (UAF) vulnerability. The fix involves ensuring the adapter is fully initialized before it is made available in the IDR for lookup. This issue primarily affects the i2c-core-base.c component.
Affected products
- Linux Linux 2.6.22 to 6.12.95, 6.18.38, 7.1.3
Timeline
- 2026-07-19: disclosed: CVE published via NVD/kernel.org
- 2026-07-19: patched