Executive brief
A race condition vulnerability was identified in the Linux kernel's I2C core component, which manages communication between the operating system and various hardware sensors or controllers. Under specific conditions during hardware removal or registration failure, the system might attempt to access memory that has already been freed. This could lead to system instability, crashes, or potentially unauthorized access to sensitive kernel information.
Technical details
A race condition exists in the Linux kernel I2C core (drivers/i2c/i2c-core-base.c) during adapter deregistration. Adapters can be looked up by ID using i2c_get_adapter(), which increments a reference count on the underlying device structure. The vulnerability occurs because the adapter was not removed from the IDR (Integer ID Management) system before its resources were torn down. This allows a concurrent process to look up and attempt to access adapter resources (such as the device name) after they have been freed, resulting in a use-after-free. The fix involves moving the IDR removal to an earlier stage in the deregistration and registration-failure paths.
Affected products
- Linux Linux 2.6.31 to 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39
Timeline
- 2026-07-25: disclosed
- 2026-07-25: patched
References
- https://git.kernel.org/stable/c/11dfa37bf544cc806f21742ca2fd2d841bd7032e
- https://git.kernel.org/stable/c/35dbd1f1f603401155cbd3a180bb18e3a3b675b8
- https://git.kernel.org/stable/c/9882a9bd74db08e7bae5821a7050627ae92d3380
- https://git.kernel.org/stable/c/b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f
- https://git.kernel.org/stable/c/b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3
- https://git.kernel.org/stable/c/bb234487a447a99315add1b46aa57b72e163e1eb
- https://git.kernel.org/stable/c/d39282f552dd6c35b9b84b4af78f1198c24f3373