CVE-2026-64279

Analyzed Analyzed - Analysis Complete

Race Condition in Linux Kernel I2C Core

Publication date: 2026-07-25

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter deregistration race Adapters can be looked up by their id using i2c_get_adapter() which takes a reference to the embedded struct device. Remove the adapter from the IDR before tearing it down during deregistration (and on registration failure) to make sure its resources are not accessed after having been freed (e.g. the device name).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64279

EUVD

EUVD-2026-48991

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 2.6.31 (inc) to 5.15.212 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition during adapter deregistration. The issue occurs when an I2C adapter is removed from the system while another process is still trying to access it via i2c_get_adapter(), which holds a reference to the adapter's device structure. This can lead to use-after-free scenarios where freed resources are accessed, potentially causing system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's i2c subsystem and does not have direct network detection methods. To check for affected systems, verify the kernel version and whether the vulnerable code path exists. Use commands like 'uname -a' to check the kernel version and 'lsmod | grep i2c' to inspect loaded i2c modules.

Impact Analysis

This vulnerability could cause system crashes or instability if an I2C adapter is deregistered while in use. It may lead to unexpected behavior, data corruption, or denial of service in systems relying on I2C devices. Users might experience application failures or kernel panics.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a race condition in the Linux kernel's i2c subsystem. No evidence suggests data breaches, unauthorized access, or privacy violations that would impact regulatory compliance.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves the i2c adapter deregistration race. Monitor vendor advisories for kernel updates and apply them promptly. If immediate patching is not possible, consider disabling or restricting access to i2c functionality if not required.

Hi! I’m here to help you understand CVE-2026-64279. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70