Executive brief
The Linux kernel's I2C multiplexer driver contains a resource leak in the adapter registration code. When the i2c_mux_add_adapter() function fails during adapter setup, it fails to release a reference to a Device Tree node, causing a memory leak. This could gradually consume kernel memory over time if adapter registration failures occur repeatedly.
Technical details
The vulnerability is a resource leak (missing object dereference) in the i2c-mux driver. The i2c_mux_add_adapter() function acquires a reference to a Device Tree channel node via of_node_get() before registering the new I2C adapter. If adapter registration fails, the error path calls kfree() on the private data structure but omits the necessary of_node_put() call to release the Device Tree node reference. The fix adds of_node_put(priv->adap.dev.of_node) in the error handler before kfree(priv). This affects kernel versions 3.5 and later. The vulnerability requires no special privileges or network access to trigger—it occurs during normal I2C mux adapter initialization when a failure condition is encountered.
Affected products
- Linux Linux kernel 3.5 and later
Timeline
- 2026-09-16: disclosed
- 2026-09-11: patched: Patch committed to stable kernel branches