CVE-2026-80680

Received Received - Intake

AMD MP2 PCI Driver Callback Dereference on Adapter Failure

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2c_add_adapter() fails, probe returns and devres frees the context, but the PCI driver can still dereference the stale pointer from its IRQ and system-sleep callbacks. Unregister the callback before returning the adapter registration error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80680

EUVD

EUVD-2026-67556

Affected Vendors & Products

Vendor	Product	Version / Range
amd	mp2	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the AMD MP2 I2C driver. When the driver fails to register an I2C adapter, it leaves a stale pointer in the PCI driver's callback table. This pointer can later be dereferenced by IRQ or system-sleep callbacks, potentially causing crashes or undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMD MP2 I2C driver and does not have network-based detection methods. Check kernel logs for errors related to i2c or amd-mp2 after system updates or driver loads.

Impact Analysis

If you use a system with an AMD MP2 I2C controller, this vulnerability could lead to system instability, crashes, or unexpected behavior during I2C operations. It may also cause issues during system sleep or when handling interrupts.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel driver issue without implications for data protection or privacy controls.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this CVE. Monitor kernel logs for i2c or amd-mp2 errors after applying updates.

Hi! I’m here to help you understand CVE-2026-80680. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70