CVE-2026-72140: i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
In the Linux kernel, the following vulnerability has been resolved:
i2c: mlxbf: Fix use-after-free in mlxbfi2cinitresource()
If devmplatformgetandioremapresource() returns an error, mlxbfi2cinitresource() frees tmpres before reading tmpres->io to get the error code. This results in a use-after-free.
Save the error code before freeing tmpres.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - Compensating control
If devm_platform_get_and_ioremap_resource() returns an error, save the error code before freeing tmp_res to avoid the use-after-free in mlxbf_i2c_init_resource().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72140?
The severity of CVE-2026-72140 is classified as risk 29.
What is the nature of the vulnerability in CVE-2026-72140?
CVE-2026-72140 pertains to a use-after-free vulnerability in the Linux kernel's mlxbf_i2c_init_resource function.
How do I fix CVE-2026-72140?
To fix CVE-2026-72140, update to the latest version of the Linux kernel where this vulnerability has been patched.
What systems are affected by CVE-2026-72140?
CVE-2026-72140 affects systems running vulnerable versions of the Linux kernel utilizing the mlxbf I2C driver.
What are the potential consequences of CVE-2026-72140?
The consequences of CVE-2026-72140 may include system instability or potential privilege escalation due to the use-after-free condition.