CVE-2026-99001

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/i2c: cancel the client work on remove

xe i2c notifier() stores the DesignWare adapter in i2c->adapter and schedules i2c->work when the adapter is registered under the xe I2C platform device, and xe i2c client work() then instantiates the AMC client device on that adapter.

xe i2c remove() tears down the AMC, unregisters the client devices, the bus notifier and the adapter platform device, but it never drains i2c->work. A work item that is still queued or running when the adapter is unregistered dereferences i2c->adapter in i2c new client device() after platform device unregister() has released the adapter. The work item is also embedded in the devm-allocated struct xe i2c, so a work item still queued after the drm device devm unwind frees that allocation runs its callback on freed memory.

The bus notifier is the only thing that schedules this work, and it is unregistered after the client devices. An instance that is still queued when the teardown runs can therefore write i2c->client[XE I2C CLIENT AMC] while the loop is unregistering and clearing the same array, and an AMC client it instantiates late is only cleaned up by the adapter's own child sweep in i2c del adapter().

Move bus unregister notifier() in front of the client teardown loop and cancel the work right after it, so no new instance can be scheduled and a queued instance is drained before the client array is touched. A running instance still finds a live adapter, since the adapter is unregistered later.

(cherry picked from commit a23f27d5ec11c3f418c5e5531eea34ccda2b5b20)