i2c: atr: fix dangling adapter pointer on add failure (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.17 % · percentile 6 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: i2c: atr: fix dangling adapter pointer on add failure i2c_atr_add_adapter() stores atr->adapter[chan_id] before i2c_add_adapter() so that the I2C bus notifier can match child clients during registration. On failure the channel is freed but the slot was left pointing at freed memory, which can lead to use-after-free in i2c_atr_del_adapter() / cleanup and also block reuse with -EEXIST. Clear the slot on the i2c_add_adapter() error path before freeing chan.
References
- https://git.kernel.org/stable/c/2f5e42edbd232bf705dc5d3a91e06344237e63bb
- https://git.kernel.org/stable/c/1093835f6aef58a831298d93e0d93f244fa07b84
- https://git.kernel.org/stable/c/eabf7a3d33cd9fad106d267d00cc842434de8e02
- https://git.kernel.org/stable/c/a57d9592714506556e30188af72dd3bdb9f647b5
- https://git.kernel.org/stable/c/ad34235808b63a70ca4989b7a2852923193d06ef
European references
- ENISA EUVD · EUVD-2026-93146
- GCVE · GCVE-0-2026-98218
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1374 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected a076a860acae77bbdcbd316541e5552e81fb1772 < 2f5e42edbd232bf705dc5d3a91e06344237e63bb ; affected a076a860acae77bbdcbd316541e5552e81fb1772 < 1093835f6aef58a831298d93e0d93f244fa07b84 ; affected a076a860acae77bbdcbd316541e5552e81fb1772 < eabf7a3d33cd9fad106d267d00cc842434de8e02 ; affected a076a860acae77bbdcbd316541e5552e81fb1772 < a57d9592714506556e30188af72dd3bdb9f647b5 ; affected a076a860acae77bbdcbd316541e5552e81fb1772 < ad34235808b63a70ca4989b7a2852923193d06ef |
| Linux · Linux | affected 6.6 ; unaffected 0 < 6.6 ; unaffected 6.6.158 ≤ 6.6.* ; unaffected 6.12.112 ≤ 6.12.* ; unaffected 6.18.54 ≤ 6.18.* ; unaffected 7.2.8 ≤ 7.2.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |