CVE-2026-89983
Received
Received - Intake
BaseFortify
Vulnerability report for CVE-2026-89983, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-16
Last updated on: 2026-09-16
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
i2c: core: fix debugfs UAF on adapter removal
i2c_del_adapter() frees the adapter's debugfs directory before it
unregisters the adapter device, but the new_device sysfs attribute
stays writable until device_del(). A write racing with removal still
reaches i2c_device_probe(), which passes the freed adap->debugfs to
debugfs_create_dir() as the new client's parent:
BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430
Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090
lookup_noperm_common+0x407/0x430
simple_start_creating+0x9c/0x110
debugfs_start_creating+0xdb/0x1a0
debugfs_create_dir+0x24/0x350
i2c_device_probe+0x814/0xbf0
It's technically possible to create a client after i2c_deregister_clients
has run. That client will never be unregistered and make
wait_for_completion hang.
Close the window by removing the new_device attribute at the start of
i2c_del_adapter(). device_remove_file() will drain any clients left.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 0e8926abfd7aee220e44be5566affd7a8580b50e |
| Linux | Linux | e2a268b0f512fb18ae5961b1fdfaf610ed6bd661 |
| Linux | Linux | 4a2be5a72865bdd219b2d8c327b9fa03e87a4a9e |
| Linux | Linux | 73febd775bdbdb98c81255ff85773ac410ded5c4 |
| Linux | Linux | 73febd775bdbdb98c81255ff85773ac410ded5c4 |
| Linux | Linux | 73febd775bdbdb98c81255ff85773ac410ded5c4 |
| Linux | Linux | 73febd775bdbdb98c81255ff85773ac410ded5c4 |
| Linux | Linux | 5.15.168 |
| Linux | Linux | 6.1.113 |
| Linux | Linux | 6.6.55 |
| Linux | Linux | 6.8 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
