CVE-2026-80680 Overview
CVE-2026-80680 is a use-after-free vulnerability in the Linux kernel's i2c: amd-mp2 driver. The flaw resides in amd_mp2_register_cb(), which stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2c_add_adapter() fails, probe returns and devres frees the context, but the PCI driver can still dereference the stale pointer from its IRQ and system-sleep callbacks. This yields a local, low-complexity path to memory corruption on affected systems.
Critical Impact
A local, low-privileged actor can trigger dereference of a freed context from IRQ and system-sleep paths, leading to kernel memory corruption with potential impact to confidentiality, integrity, and availability.
Affected Products
- Linux kernel with the i2c-amd-mp2 driver enabled
- AMD platforms exposing the MP2 I2C PCI device
- Distributions shipping the affected upstream kernel prior to the fix commits
Discovery Timeline
- 2026-08-28 - CVE-2026-80680 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80680
Vulnerability Analysis
The defect is a lifetime management error in the AMD MP2 I2C platform driver. The function amd_mp2_register_cb() publishes a pointer to the platform I2C context into the MP2 PCI driver's callback table. It performs this publication before calling i2c_add_adapter() to register the adapter. If adapter registration fails, the probe routine returns the error to the driver core.
At that point, devres frees the allocated context associated with the failed probe. The PCI driver, however, retains the previously stored callback pointer. Subsequent IRQ delivery or system-sleep transitions invoke the callback and dereference the now-freed memory. The result is a classic use-after-free reachable without user interaction.
Root Cause
The root cause is ordering: the callback registration occurs before the adapter is successfully added, and the error path does not unregister the callback. The upstream fix, applied across commits 1883a09, 2f7789b, 4786d4d, 8204879, 8bf7196, 9142a3d, b7c2c5c, and cf107c5, unregisters the callback before returning the adapter registration error, ensuring the PCI driver never dereferences a stale context.
Attack Vector
Exploitation requires local access with the ability to influence probe of the i2c-amd-mp2 driver or to induce adapter registration failure. Once the stale pointer is present in the PCI driver's callback table, an IRQ or a system-sleep event drives the use-after-free. Successful exploitation of a kernel use-after-free can enable privilege escalation or denial of service. No verified proof-of-concept has been published.
No verified exploitation code is available. See the referenced kernel commits for the exact patch diff.
Detection Methods for CVE-2026-80680
Indicators of Compromise
- Kernel oops, BUG, or KASAN reports referencing amd_mp2, i2c-amd-mp2, or amd_mp2_register_cb in the call trace.
- Repeated probe failures for the AMD MP2 I2C adapter followed by IRQ or suspend/resume anomalies.
- Unexpected kernel panics during system suspend, resume, or PCI IRQ handling on AMD platforms with MP2.
Detection Strategies
- Inventory running kernel versions and cross-reference against distribution advisories citing the listed fix commits.
- Enable KASAN on test kernels to surface the use-after-free in amd_mp2 code paths.
- Monitor dmesg and journald for i2c_add_adapter failures on hosts with the AMD MP2 controller.
Monitoring Recommendations
- Forward kernel logs to a central telemetry pipeline and alert on amd_mp2 oops signatures.
- Track PCI probe failures and suspend/resume errors on AMD endpoints in fleet telemetry.
- Correlate local privilege-escalation indicators on Linux hosts with recent kernel fault events.
How to Mitigate CVE-2026-80680
Immediate Actions Required
- Apply the vendor kernel update that includes the upstream i2c amd-mp2 fix commits as soon as it is available.
- Prioritize patching on AMD-based laptops and workstations where the MP2 I2C controller is present.
- Restrict local access on unpatched systems to reduce exposure to local, low-privileged actors.
Patch Information
The upstream Linux kernel resolves the issue by unregistering the callback before returning the adapter registration error. Fixes are tracked in the following commits: Linux Kernel Commit 1883a09, Linux Kernel Commit 2f7789b, Linux Kernel Commit 4786d4d, Linux Kernel Commit 8204879, Linux Kernel Commit 8bf7196, Linux Kernel Commit 9142a3d, Linux Kernel Commit b7c2c5c, and Linux Kernel Commit cf107c5.
Workarounds
- Blacklist the i2c-amd-mp2-pci and i2c-amd-mp2-plat modules on systems where the controller is not required.
- Disable suspend/resume on unpatched systems if the MP2 controller cannot be unloaded, to reduce reachability of the vulnerable callback path.
- Enforce least-privilege on local accounts and remove interactive access for service users pending patch deployment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
