CVE-2026-64279 Details
Description
In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter deregistration race Adapters can be looked up by their id using i2c_get_adapter() which takes a reference to the embedded struct device. Remove the adapter from the IDR before tearing it down during deregistration (and on registration failure) to make sure its resources are not accessed after having been freed (e.g. the device name).
A race condition vulnerability has been identified in the Linux kernel's I2C core management. This issue arises during the deregistration of I2C adapters, which can lead to the improper handling of adapter resources. The vulnerability is present in the Linux kernel stable tree, specifically in versions prior to the latest commit that addresses this issue. The problem occurs because adapters can be looked up by their ID using the 'i2c_get_adapter()' function, which references the associated device structure. If an adapter is removed from the IDR (ID Radix Tree) only after it has been fully deregistered, there is a risk that its resources, such as the device name, may be accessed even after they have been freed. This vulnerability can be exploited by causing a registration failure or by manipulating the deregistration process, leading to a use-after-free scenario.
Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the latest stable kernel version can be found on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-019113.html | siemens-SADP | |
| https://git.kernel.org/stable/c/11dfa37bf544cc806f21742ca2fd2d841bd7032e | kernel.org | Patch |
| https://git.kernel.org/stable/c/35dbd1f1f603401155cbd3a180bb18e3a3b675b8 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9882a9bd74db08e7bae5821a7050627ae92d3380 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f | kernel.org | Patch |
| https://git.kernel.org/stable/c/b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/bb234487a447a99315add1b46aa57b72e163e1eb | kernel.org | Patch |
| https://git.kernel.org/stable/c/d39282f552dd6c35b9b84b4af78f1198c24f3373 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.31, < 5.15.212 >= 5.16, < 6.1.178 >= 6.2, < 6.6.145 >= 6.7, < 6.12.96 >= 6.13, < 6.18.39 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | kernel.org |
| Sep 8, 2026 | CVE Modified | siemens-SADP |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Aug 13, 2026 | Initial Analysis | [email protected] |
| Jul 27, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |