CVE-2026-89983: Linux Kernel i2c Core UAF Vulnerability

CVE-2026-89983 Overview

CVE-2026-89983 is a use-after-free (UAF) vulnerability in the Linux kernel's Inter-Integrated Circuit (i2c) core subsystem. The flaw exists in the adapter removal path, where i2c_del_adapter() frees the adapter's debugfs directory before unregistering the adapter device. The new_device sysfs attribute remains writable until device_del() completes, creating a race window. A write to new_device that races with adapter removal reaches i2c_device_probe(), which then passes the freed adap->debugfs pointer to debugfs_create_dir() as the new client's parent. KASAN reports the resulting slab-use-after-free in lookup_noperm_common.

Critical Impact
A local attacker with sysfs write access can trigger a kernel use-after-free during i2c adapter removal, leading to memory corruption, kernel crashes, or hung processes waiting on wait_for_completion.

Affected Products

Linux kernel i2c core subsystem prior to the fix commits
Distributions shipping affected upstream kernel versions
Systems exposing writable new_device sysfs attributes on i2c adapters

Discovery Timeline

2026-09-16 - CVE-2026-89983 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89983

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] triggered by a race between i2c adapter removal and sysfs-driven client instantiation. During i2c_del_adapter(), the kernel tears down the adapter's debugfs directory before it removes the underlying device. Because the new_device sysfs attribute remains writable until device_del() runs, userspace can still request creation of a new i2c client during this window.

When the racing write reaches i2c_device_probe(), the probe path calls debugfs_create_dir() using the adapter's already-freed debugfs pointer as the parent. This triggers a slab-use-after-free in lookup_noperm_common(), detected by the Kernel Address Sanitizer (KASAN).

A secondary defect compounds the issue. It is possible for a client to be created after i2c_deregister_clients has completed. That client is never unregistered, causing the removal path's wait_for_completion to hang indefinitely.

Root Cause

The root cause is incorrect ordering of teardown steps in i2c_del_adapter(). The adapter's debugfs directory is released before the new_device sysfs attribute is removed. Because probe operations on i2c clients dereference the parent debugfs handle, the freed pointer becomes reachable through a legitimate userspace code path.

Attack Vector

Exploitation requires local access with permission to write to the i2c adapter's new_device sysfs attribute, which is typically restricted to privileged users. An attacker races a write to new_device against removal of the underlying i2c adapter (for example, via module unload or hot-unplug). Successful timing yields a kernel-mode use-after-free that can result in a crash, hung processes, or potential memory corruption depending on slab reuse.

The fix, applied across the kernel stable branches, removes the new_device attribute at the start of i2c_del_adapter(). The device_remove_file() call drains in-flight writers before the adapter's debugfs directory is torn down. See the Linux Kernel Commit 643fb87 for the canonical fix.

Detection Methods for CVE-2026-89983

Indicators of Compromise

KASAN reports referencing slab-use-after-free in lookup_noperm_common originating from i2c_device_probe and debugfs_create_dir.
Kernel processes stuck in wait_for_completion during i2c adapter removal or module unload.
Unexpected kernel oops or panic entries in dmesg correlated with writes to /sys/bus/i2c/devices/i2c-*/new_device.

Detection Strategies

Enable KASAN on test and pre-production kernels to surface the use-after-free during fuzzing of sysfs attributes.
Audit access to i2c adapter sysfs attributes and alert on unexpected writers to new_device while adapter removal events occur.
Correlate kernel crash telemetry with i2c driver load and unload activity to identify race-driven failures.

Monitoring Recommendations

Ingest kernel logs (/var/log/kern.log, journald) into a centralized data lake and alert on KASAN and BUG: signatures involving i2c_device_probe.
Monitor hung task warnings and INFO: task ... blocked for more than N seconds entries tied to i2c teardown paths.
Track loading and unloading of i2c bus and client kernel modules to establish a baseline for anomaly identification.

How to Mitigate CVE-2026-89983

Immediate Actions Required

Upgrade to a kernel version that includes the upstream fix commits listed in the vendor references.
Restrict write permissions on /sys/bus/i2c/devices/i2c-*/new_device to trusted administrative accounts only.
Avoid dynamic unloading of i2c bus drivers on production systems until patched kernels are deployed.

Patch Information

The fix removes the new_device sysfs attribute at the start of i2c_del_adapter() so that device_remove_file() drains any in-flight writers before the adapter's debugfs directory is torn down. Patches are available across multiple stable branches:

Workarounds

Tighten filesystem permissions and udev rules on i2c adapter sysfs entries to prevent unprivileged writes to new_device.
Disable or blacklist unused i2c drivers on systems where the subsystem is not required.
Avoid runtime removal of i2c adapters while userspace agents may write to new_device until the kernel is patched.