CVE-2026-64279 Overview
CVE-2026-64279 is a race condition vulnerability in the Linux kernel's Inter-Integrated Circuit (i2c) core subsystem. The flaw exists in the adapter deregistration path, where adapter resources can be accessed after being freed. Adapters are looked up by identifier through i2c_get_adapter(), which takes a reference to the embedded struct device. The vulnerability arises because the adapter was not removed from the Identifier (IDR) allocator before teardown during deregistration or on registration failure. This allows concurrent lookups to access freed resources, such as the device name.
Critical Impact
A local, low-privileged attacker can trigger a use-after-free condition in kernel memory, potentially leading to privilege escalation, kernel information disclosure, or denial of service.
Affected Products
- Linux kernel (upstream)
- Linux stable branches referenced by the fix commits
- Distributions shipping vulnerable i2c core code
Discovery Timeline
- 2026-07-25 - CVE-2026-64279 published to the National Vulnerability Database
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64279
Vulnerability Analysis
The vulnerability resides in the i2c core deregistration flow of the Linux kernel. The i2c_get_adapter() function performs adapter lookups by identifier and increments the reference count on the embedded struct device. During deregistration, the adapter was torn down while its identifier remained registered in the IDR structure. A concurrent caller invoking i2c_get_adapter() could therefore obtain a pointer to an adapter whose backing resources, including the device name, had already been released.
The upstream fix removes the adapter from the IDR before performing teardown and also handles the registration failure path. This ordering ensures that no new lookups can obtain a reference to an adapter that is in the process of being freed. The resulting use-after-free window aligns with the [CWE-416] class of memory safety defects.
Root Cause
The root cause is an ordering flaw between IDR removal and resource release. The original code freed adapter resources before removing the identifier from the IDR. Any thread that resolved the adapter identifier in that window received a stale pointer to freed memory.
Attack Vector
Exploitation requires local access with the ability to interact with i2c interfaces or trigger adapter registration and deregistration events. An attacker races an adapter deregistration against an i2c_get_adapter() call, then dereferences the freed adapter to corrupt kernel memory or leak sensitive kernel data.
The vulnerability is described in prose only; refer to the upstream commits for the exact patched code paths, including commit 11dfa37b and commit d39282f5.
Detection Methods for CVE-2026-64279
Indicators of Compromise
- Kernel oops or panic messages referencing i2c_get_adapter, i2c_del_adapter, or freed struct device access
- KASAN reports flagging use-after-free reads or writes in the i2c core during adapter teardown
- Unexpected process termination or kernel crashes on systems that dynamically load and unload i2c bus drivers
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) in test environments to surface use-after-free access in i2c code paths
- Audit installed kernel versions against the fixed stable branches identified in the upstream commits
- Correlate kernel log entries with process activity to identify local processes attempting to race adapter deregistration
Monitoring Recommendations
- Forward dmesg and /var/log/kern.log to a centralized logging platform for detection of kernel memory corruption signatures
- Monitor for unprivileged processes repeatedly opening /dev/i2c-* device nodes in tight loops
- Track kernel package versions across the fleet and alert on hosts running unpatched kernels
How to Mitigate CVE-2026-64279
Immediate Actions Required
- Apply the patched Linux kernel package provided by your distribution vendor at the earliest maintenance window
- Restrict access to /dev/i2c-* device nodes to trusted administrative accounts through file permissions and group membership
- Prioritize patching on multi-tenant systems and hosts where untrusted local users have shell access
Patch Information
The fix is delivered through multiple Linux stable kernel commits, including commit 11dfa37b, commit 35dbd1f1, commit 9882a9bd, commit b1a58ed9, commit b6d2af6f, commit bb234487, and commit d39282f5. Each commit modifies the i2c core to remove the adapter from the IDR before releasing its resources.
Workarounds
- Where patching is not immediately feasible, blacklist unused i2c bus drivers to reduce the attack surface for adapter registration and deregistration events
- Enforce strict permissions on /dev/i2c-* nodes so only privileged administrative users can open i2c interfaces
- Disable dynamic loading and unloading of i2c modules on production systems by removing associated kernel modules from the initramfs when they are not required
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
