CVE-2026-89982 Overview
CVE-2026-89982 is a resource management flaw in the Linux kernel's I2C multiplexer subsystem. The function i2c_mux_add_adapter() acquires a reference to a Device Tree channel node before registering a new adapter. When adapter registration fails, the error path frees the private data without releasing that node reference. This results in a reference count leak on the of_node structure each time adapter registration fails.
Critical Impact
Repeated adapter registration failures leak Device Tree node references, degrading kernel resource accounting and potentially preventing proper cleanup of associated kernel objects.
Affected Products
- Linux kernel (upstream stable trees)
- Systems using the i2c-mux subsystem with Device Tree channel definitions
- Distributions shipping vulnerable kernel builds prior to the referenced stable commits
Discovery Timeline
- 2026-09-16 - CVE-2026-89982 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89982
Vulnerability Analysis
The defect resides in i2c_mux_add_adapter() within the Linux kernel I2C multiplexer core. The function walks the Device Tree to locate the channel node associated with the new adapter, taking a reference through the standard of_node_get() accounting. This reference must be released once the caller finishes using the node.
On the success path, the reference is dropped correctly. On the failure path, when i2c_add_adapter() or a related registration step fails, the code proceeds directly to kfree() of the private mux client structure. The node reference is never released, producing a leak categorized as [CWE-401] Missing Release of Memory after Effective Lifetime, applied here to a Device Tree node reference.
Root Cause
The root cause is an incomplete error handling path. The channel node reference is acquired unconditionally before registration is attempted, but the cleanup logic on the failure branch omits the corresponding of_node_put() call. The fix reorders the failure handler to release the channel node before freeing the private data.
Attack Vector
This is a local, kernel-internal resource leak. It is not directly reachable by unprivileged remote actors. Exploitation requires conditions that trigger repeated adapter registration failures, typically driver probe errors on embedded platforms with I2C multiplexers described in Device Tree. The primary impact is resource exhaustion and impaired kernel object lifecycle management rather than memory corruption or privilege escalation.
The vulnerability is described in the kernel commit series; consult the Kernel Git Commit 0927153 and Kernel Git Commit 4f42f70 for the corrected error paths.
Detection Methods for CVE-2026-89982
Indicators of Compromise
- Repeated i2c_mux_add_adapter failure messages in dmesg or journalctl -k output
- Persistent Device Tree node reference counts that do not decrement after driver unload events
- Kernel warnings tied to of_node lifetime accounting on affected platforms
Detection Strategies
- Audit installed kernel versions against the fixed stable commits referenced in the NVD entry
- Instrument test builds with CONFIG_OF_DYNAMIC and CONFIG_DEBUG_KOBJECT_RELEASE to surface reference imbalances
- Review platform driver probe logs on hardware that instantiates I2C multiplexers via Device Tree
Monitoring Recommendations
- Track kernel package versions across Linux fleets and correlate to the fixed commit hashes
- Monitor kernel ring buffer output for recurrent I2C mux registration failures
- Include kernel driver probe telemetry in centralized logging for embedded and edge devices
How to Mitigate CVE-2026-89982
Immediate Actions Required
- Update to a Linux stable kernel release that incorporates the fix commits listed in the NVD advisory
- Rebuild custom or vendor kernels against a patched source tree before redeployment
- Validate that I2C multiplexer drivers probe successfully after the update on affected hardware
Patch Information
The upstream fix releases the channel node reference before freeing the private data in the failure path of i2c_mux_add_adapter(). Backports are available across multiple stable branches. See Kernel Git Commit 2b3b06c, Kernel Git Commit 385c7af, Kernel Git Commit 4c9bc46, Kernel Git Commit 694e7e6, Kernel Git Commit b580f06, and Kernel Git Commit dd2c1e6 for the applicable stable series.
Workarounds
- No functional workaround exists at runtime; the fix must be applied in the kernel source
- Reduce exposure by addressing root causes of adapter registration failures on affected platforms
- Limit repeated driver reload cycles on unpatched systems to minimize accumulated reference leaks
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.