CVE-2026-80680: i2c: amd-mp2: Unregister callback on adapter add failure
In the Linux kernel, the following vulnerability has been resolved:
i2c: amd-mp2: Unregister callback on adapter add failure
amdmp2registercb() stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2caddadapter() fails, probe returns and devres frees the context, but the PCI driver can still dereference the stale pointer from its IRQ and system-sleep callbacks.
Unregister the callback before returning the adapter registration error.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Unregister the MP2 platform I2C/system-sleep callback before returning the adapter registration error when i2c_add_adapter() fails (i2c: amd-mp2: Unregister callback on adapter add failure).
Event History
Frequently Asked Questions
Under what condition can this issue be triggered?
The issue requires i2c_add_adapter() to fail after amd_mp2_register_cb() has stored the platform I2C context in the MP2 PCI driver's callback table. The subsequent IRQ or system-sleep callback can then dereference the stale context pointer.
What kernel activity can reach the stale pointer?
The stale pointer may be accessed through the MP2 PCI driver's IRQ callbacks or its system-sleep callbacks after adapter registration fails.
What does the fix change?
The fix unregisters the callback before returning the adapter-registration error. This prevents the PCI driver's callback table from retaining a pointer to context that devres will free.