Executive brief
The Linux kernel's AMD MP2 I2C controller driver failed to properly clean up callback registrations when I2C adapter initialization failed. This left a stale pointer in the driver's callback table that could be dereferenced by interrupt handlers or system-sleep routines, potentially causing a system crash or arbitrary code execution. Systems running affected kernel versions with AMD MP2 I2C hardware are at risk of denial of service or privilege escalation.
Technical details
A use-after-free vulnerability exists in the AMD MP2 I2C driver (i2c-amd-mp2-plat). The root cause is that amd_mp2_register_cb() registers a PCI driver callback and stores a pointer to the platform I2C context before validating that i2c_add_adapter() succeeds. If adapter registration fails, the probe function returns but devres automatically frees the context; however, the callback table still holds the freed pointer. Subsequent IRQ or system-sleep handlers invoking the registered callback dereference this stale pointer. The fix adds an explicit amd_mp2_unregister_cb() call before returning the adapter registration error. Network attack vectors are unlikely; local attack requires kernel exposure. The vulnerability affects Linux v5.2 and later; patches have been backported to stable kernels.
Affected products
- Linux Linux kernel 5.2 and later
Timeline
- 2026-08-28: disclosed
- 2026-08-09: patched