CVE-2026-89983

i2c: core: fix debugfs UAF on adapter removal

Published Sep 16, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

i2c: core: fix debugfs UAF on adapter removal

i2c_del_adapter() frees the adapter's debugfs directory before it
unregisters the adapter device, but the new_device sysfs attribute
stays writable until device_del(). A write racing with removal still
reaches i2c_device_probe(), which passes the freed adap->debugfs to
debugfs_create_dir() as the new client's parent:

BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430
Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090
lookup_noperm_common+0x407/0x430
simple_start_creating+0x9c/0x110
debugfs_start_creating+0xdb/0x1a0
debugfs_create_dir+0x24/0x350
i2c_device_probe+0x814/0xbf0

It's technically possible to create a client after i2c_deregister_clients
has run. That client will never be unregistered and make
wait_for_completion hang.

Close the window by removing the new_device attribute at the start of
i2c_del_adapter(). device_remove_file() will drain any clients left.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0e8926abfd7aee220e44be5566affd7a8580b50e`	affected	< dc33a9762538b3250ed6b5644a4d44c748be33a6
`e2a268b0f512fb18ae5961b1fdfaf610ed6bd661`	affected	< 1f1bcd4eca6caa3e4258d9a31925112539406eb6
`4a2be5a72865bdd219b2d8c327b9fa03e87a4a9e`	affected	< f9094ace03e0a532cc6505d2e97b61ae738da4ed
`73febd775bdbdb98c81255ff85773ac410ded5c4`	affected	< 643fb872aa04342d27dbef52b2b3cf3fe71b2c7b
`73febd775bdbdb98c81255ff85773ac410ded5c4`	affected	< 112b3d48084c820bbccf41d9783fd122e3ac4cb0
`73febd775bdbdb98c81255ff85773ac410ded5c4`	affected	< 552836be2d95c688eede6371f85532abe1a71232
`73febd775bdbdb98c81255ff85773ac410ded5c4`	affected	< b15b548d52b43ba8ac4652bc2c7244a8dd1e9622
`5.15.168`	affected	< 5.15.221
`6.1.113`	affected	< 6.1.188
`6.6.55`	affected	< 6.6.157

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[0e8926abfd7aee220e44be5566affd7a8580b50e,dc33a9762538b3250ed6b5644a4d44c748be33a6)`	affected	code_commit	—
`[e2a268b0f512fb18ae5961b1fdfaf610ed6bd661,1f1bcd4eca6caa3e4258d9a31925112539406eb6)`	affected	code_commit	—
`[4a2be5a72865bdd219b2d8c327b9fa03e87a4a9e,f9094ace03e0a532cc6505d2e97b61ae738da4ed)`	affected	code_commit	—
`[73febd775bdbdb98c81255ff85773ac410ded5c4,643fb872aa04342d27dbef52b2b3cf3fe71b2c7b)`	affected	code_commit	—
`[73febd775bdbdb98c81255ff85773ac410ded5c4,112b3d48084c820bbccf41d9783fd122e3ac4cb0)`	affected	code_commit	—
`[73febd775bdbdb98c81255ff85773ac410ded5c4,552836be2d95c688eede6371f85532abe1a71232)`	affected	code_commit	—
`[73febd775bdbdb98c81255ff85773ac410ded5c4,b15b548d52b43ba8ac4652bc2c7244a8dd1e9622)`	affected	code_commit	—
`[5.15.168,5.15.221)`	affected	semver	—
`[6.1.113,6.1.188)`	affected	semver	—
`[6.6.55,6.6.157)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.8`	affected	semver	—
`[0,6.8)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.211% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/112b3d48084c820bbccf41d9783fd122e3ac4cb0
https://git.kernel.org/stable/c/1f1bcd4eca6caa3e4258d9a31925112539406eb6
https://git.kernel.org/stable/c/552836be2d95c688eede6371f85532abe1a71232
https://git.kernel.org/stable/c/643fb872aa04342d27dbef52b2b3cf3fe71b2c7b
https://git.kernel.org/stable/c/b15b548d52b43ba8ac4652bc2c7244a8dd1e9622
https://git.kernel.org/stable/c/dc33a9762538b3250ed6b5644a4d44c748be33a6
https://git.kernel.org/stable/c/f9094ace03e0a532cc6505d2e97b61ae738da4ed

History

Sep 17, 2026 11:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sep 16, 2026 10:45 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix debugfs UAF on adapter removal i2c_del_adapter() frees the adapter's debugfs directory before it unregisters the adapter device, but the new_device sysfs attribute stays writable until device_del(). A write racing with removal still reaches i2c_device_probe(), which passes the freed adap->debugfs to debugfs_create_dir() as the new client's parent: BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430 Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090 lookup_noperm_common+0x407/0x430 simple_start_creating+0x9c/0x110 debugfs_start_creating+0xdb/0x1a0 debugfs_create_dir+0x24/0x350 i2c_device_probe+0x814/0xbf0 It's technically possible to create a client after i2c_deregister_clients has run. That client will never be unregistered and make wait_for_completion hang. Close the window by removing the new_device attribute at the start of i2c_del_adapter(). device_remove_file() will drain any clients left.
Title		i2c: core: fix debugfs UAF on adapter removal
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/112b3d48084c820bbccf41d9783fd122e3ac4cb0 https://git.kernel.org/stable/c/1f1bcd4eca6caa3e4258d9a31925112539406eb6 https://git.kernel.org/stable/c/552836be2d95c688eede6371f85532abe1a71232 https://git.kernel.org/stable/c/643fb872aa04342d27dbef52b2b3cf3fe71b2c7b https://git.kernel.org/stable/c/b15b548d52b43ba8ac4652bc2c7244a8dd1e9622 https://git.kernel.org/stable/c/dc33a9762538b3250ed6b5644a4d44c748be33a6 https://git.kernel.org/stable/c/f9094ace03e0a532cc6505d2e97b61ae738da4ed