CVE-2026-89983

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free (UAF) issue exists in the i2c core during adapter removal. The i2c del adapter() function frees the adapter's debugfs directory before the adapter device is unregistered. However, the new device sysfs attribute remains writable until device del() is called. A write operation racing with the removal process can reach the i2c device probe() function, which then passes the already freed adap->debugfs to debugfs create dir() as the parent for a new client. Additionally, it is possible to create a client after i2c deregister clients() has executed, which may cause wait for completion() to hang because the client will never be unregistered.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.