CVE-2026-89983: i2c: core: fix debugfs UAF on adapter removal

Published Sep 16, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

i2c: core: fix debugfs UAF on adapter removal

i2cdeladapter() frees the adapter's debugfs directory before it unregisters the adapter device, but the newdevice sysfs attribute stays writable until devicedel(). A write racing with removal still reaches i2cdeviceprobe(), which passes the freed adap->debugfs to debugfscreatedir() as the new client's parent:

BUG: KASAN: slab-use-after-free in lookupnopermcommon+0x407/0x430 Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090 lookupnopermcommon+0x407/0x430 simplestartcreating+0x9c/0x110 debugfsstartcreating+0xdb/0x1a0 debugfscreatedir+0x24/0x350 i2cdeviceprobe+0x814/0xbf0

It's technically possible to create a client after i2cderegisterclients has run. That client will never be unregistered and make waitforcompletion hang.

Close the window by removing the newdevice attribute at the start of i2cdeladapter(). deviceremovefile() will drain any clients left.

Affected Software

1 affected component
Linux Kernel

Event History

Sep 16, 2026
CVE Published
via MITRE·10:32 AM
Data Sourced
via MITRE·10:32 AM
Description

Frequently Asked Questions

1

What conditions are required to trigger the use-after-free?

A write to an I2C adapter's writable new_device sysfs attribute must race with removal of that adapter. The write can reach i2c_device_probe() after the adapter's debugfs directory has been freed but before the adapter device is unregistered.

2

What additional impact can occur besides the use-after-free?

A client can technically be created after i2c_deregister_clients has run. That client will not be unregistered, which can cause wait_for_completion to hang.

3

What does the fix change?

The fix removes the new_device attribute at the start of i2c_del_adapter(), closing the race window. device_remove_file() also drains clients that remain.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203