Executive brief
The Linux kernel's i2c (Inter-Integrated Circuit) core module contains a use-after-free vulnerability in its debugfs handling during adapter device removal. An attacker with local access could trigger a race condition to cause a kernel crash or potential code execution by writing to a sysfs attribute while an i2c adapter is being removed from the system.
Technical details
The vulnerability is a use-after-free (UAF) bug in drivers/i2c/i2c-core-base.c within the i2c_del_adapter() function. The root cause is that i2c_del_adapter() frees the adapter's debugfs directory before unregistering the device, but the new_device sysfs attribute remains writable until device_del() completes. A concurrent write to new_device can race with removal and reach i2c_device_probe(), which then passes the already-freed adap->debugfs pointer to debugfs_create_dir(), triggering the UAF. Additionally, a client can technically be created after i2c_deregister_clients() completes, resulting in an unregistered client that causes wait_for_completion() to hang. The fix removes the new_device sysfs attribute at the start of i2c_del_adapter() to drain any in-flight writers. The vulnerability affects Linux kernel v6.8 and later. Local access is required to trigger the race condition via sysfs writes.
Affected products
- Linux Linux kernel v6.8 and later
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-08-12: patched: Fix committed to kernel (commit 112b3d48084c820bbccf41d9783fd122e3ac4cb0)
- 2026-09-11: advisory: Patch merged to stable kernel trees