HIGH Introduced in 5.2
i2c Callback UAF
CVE-2026-80680
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2c_add_adapter() fails, probe returns and devres frees the context, but the PCI driver can still dereference the stale pointer from its IRQ and system-sleep callbacks. Unregister the callback before returning the adapter registration error.
02KernelScan AI Analysis
Risk summary
A use-after-free exists in the AMD MP2 I2C platform driver where a stale callback pointer remains in the PCI driver's callback table after adapter registration fails and the context is freed. An interrupt or system-sleep transition can then dereference the freed memory. This requires AMD PCIe MP2 I2C controller hardware to be present and a local attacker able to influence adapter registration failure.
Vulnerability analysis
During device initialization, the platform driver saves a callback pointer in the PCI driver's table before registering the I2C adapter. If adapter registration fails, initialization returns an error and the kernel automatically frees the platform context, but the callback pointer remains in the PCI driver's table. A later interrupt or system suspend/resume event can then dereference the freed memory, causing a use-after-free. The fix removes the callback in the failure path so the PCI driver no longer holds a stale pointer. This vulnerability only affects systems with the AMD PCIe MP2 I2C controller hardware, and an attacker would need local access to influence the adapter registration failure and then wait for an interrupt or suspend/resume cycle to trigger the stale dereference.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.2 | 5.10.265 | 9142a3dcff0d |
| 5.15 | 5.2 | 5.15.216 | 2f7789b3a962 |
| 6.1 | 5.2 | 6.1.183 | 4786d4d70dcd |
| 6.12 | 5.2 | 6.12.103 | cf107c5983dc |
| 6.18 | 5.2 | 6.18.44 | 1883a09a37fe |
| 6.6 | 5.2 | 6.6.151 | b7c2c5c88687 |
| 7.1 | 5.2 | 7.1.8 | 8bf719659406 |
| mainline | 5.2 | 7.2 | 82048795242f |
| cip/5.10 | 5.2 | 5.10.268-cip77 | 9142a3dcff0d |
| cip/5.10-rt | 5.2 | 5.10.268-cip77-rt34 | 9142a3dcff0d |
| cip/6.1 | 5.2 | 6.1.187-cip60 | 4786d4d70dcd |
| cip/6.1-rt | 5.2 | 6.1.189-cip61-rt32 | 4786d4d70dcd |
| cip/6.12 | 5.2 | 6.12.104-cip30 | cf107c5983dc |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.104-cip30 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |