CVE-2026-64589: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64589 Overview

CVE-2026-64589 is a null pointer dereference vulnerability in the Linux kernel's Inter-Integrated Circuit (i2c) core subsystem. The flaw resides in the i2c adapter registration path, where a failed registration triggers a release callback that dereferences an uninitialized completion structure. Before the offending commit, the same failure path caused only a minor memory leak of the adapter name. The vulnerability has been resolved upstream through multiple stable kernel commits.

Critical Impact
A failed i2c adapter registration causes a kernel-level null pointer dereference, resulting in a system crash and denial of service on affected Linux hosts.

Affected Products

Linux kernel i2c core subsystem (drivers/i2c/i2c-core-base)
Stable kernel branches referenced by upstream fix commits
Linux distributions shipping vulnerable kernel versions prior to backport

Discovery Timeline

2026-08-06 - CVE-2026-64589 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-64589

Vulnerability Analysis

The defect is a null pointer dereference [CWE-476] in the i2c core adapter registration workflow. When an i2c adapter is registered via i2c_add_adapter() or its numbered variant and registration fails, the kernel invokes the release callback for the underlying device object. That callback references a struct completion field embedded in the adapter, but the completion is initialized only after the point of failure. Dereferencing the uninitialized completion produces a kernel oops.

The commit message notes that before the offending change, the same error path leaked the adapter name rather than crashing. The regression converted a benign resource leak into a fault that terminates the calling context in kernel space.

Root Cause

The root cause is an initialization ordering error. The release callback registered on the adapter's struct device assumes lifecycle invariants that hold only after successful registration. Because the completion structure is not initialized prior to the failure window, the callback operates on uninitialized memory when the driver core walks the cleanup path.

Attack Vector

The fault is triggered locally through kernel code paths that register i2c adapters, typically during module load, hotplug events, or bus enumeration. Reaching the vulnerable path requires an adapter registration failure, which can occur under resource pressure, malformed device configuration, or driver initialization errors. The primary observable impact is a crash of the kernel context handling registration, not remote exploitation.

See the upstream patch series for technical details: Kernel Git Commit 034e30, Kernel Git Commit 2295d2, Kernel Git Commit 2ce0a7, and Kernel Git Commit 3351c5.

Detection Methods for CVE-2026-64589

Indicators of Compromise

Kernel oops or panic messages referencing i2c-core, i2c_add_adapter, or the adapter release callback in dmesg and /var/log/kern.log.
Repeated i2c driver initialization failures immediately preceding a null pointer dereference stack trace.
Unexpected system reboots on hosts loading or hot-plugging i2c bus drivers.

Detection Strategies

Audit installed kernel package versions against distribution advisories that reference the upstream i2c core commits.
Parse kernel ring buffer output for signatures such as BUG: unable to handle kernel NULL pointer dereference correlated with i2c symbols.
Track driver module load failures on embedded and server hardware exposing i2c buses.

Monitoring Recommendations

Forward kern.log and journald kernel messages to a centralized log platform and alert on kernel oops patterns tied to i2c symbols.
Monitor host uptime and unplanned reboots on systems that rely on i2c-attached sensors, EEPROMs, or peripheral controllers.
Track kernel package inventory across the Linux estate to identify hosts still running pre-patch kernels.

How to Mitigate CVE-2026-64589

Immediate Actions Required

Apply the vendor kernel update that incorporates the upstream i2c core fix commits referenced by CVE-2026-64589.
Reboot affected systems after patch installation to load the corrected kernel image.
Prioritize patching of embedded, IoT, and server platforms that register i2c adapters at boot or during hotplug.

Patch Information

The fix is available upstream through the stable kernel commits listed in the CVE record: 034e30, 2295d2, 2ce0a7, and 3351c5. Consume the fix through your Linux distribution's stable kernel update channel.

Workarounds

No supported configuration-based workaround exists; the defect lives in the kernel adapter registration path.
Reduce exposure by avoiding out-of-tree i2c drivers known to fail registration under load until patched kernels are deployed.
Where feasible, disable or unbind non-essential i2c controllers on affected hosts until the fixed kernel is installed.

bash

# Verify running kernel version and package origin
uname -r
cat /proc/version

# Debian/Ubuntu: install the latest stable kernel and reboot
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot

# RHEL/CentOS/Fedora: update the kernel package and reboot
sudo dnf update kernel
sudo reboot