GHSA-XR2V-8C9Q-CQGW
Vulnerability from github – Published: 2026-09-16 12:30 – Updated: 2026-09-16 12:30In the Linux kernel, the following vulnerability has been resolved:
i2c: core: fix debugfs UAF on adapter removal
i2c_del_adapter() frees the adapter's debugfs directory before it unregisters the adapter device, but the new_device sysfs attribute stays writable until device_del(). A write racing with removal still reaches i2c_device_probe(), which passes the freed adap->debugfs to debugfs_create_dir() as the new client's parent:
BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430 Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090 lookup_noperm_common+0x407/0x430 simple_start_creating+0x9c/0x110 debugfs_start_creating+0xdb/0x1a0 debugfs_create_dir+0x24/0x350 i2c_device_probe+0x814/0xbf0
It's technically possible to create a client after i2c_deregister_clients has run. That client will never be unregistered and make wait_for_completion hang.
Close the window by removing the new_device attribute at the start of i2c_del_adapter(). device_remove_file() will drain any clients left.
{
"affected": [],
"aliases": [
"CVE-2026-89983"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T11:17:09Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: core: fix debugfs UAF on adapter removal\n\ni2c_del_adapter() frees the adapter\u0027s debugfs directory before it\nunregisters the adapter device, but the new_device sysfs attribute\nstays writable until device_del(). A write racing with removal still\nreaches i2c_device_probe(), which passes the freed adap-\u003edebugfs to\ndebugfs_create_dir() as the new client\u0027s parent:\n\n BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430\n Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090\n lookup_noperm_common+0x407/0x430\n simple_start_creating+0x9c/0x110\n debugfs_start_creating+0xdb/0x1a0\n debugfs_create_dir+0x24/0x350\n i2c_device_probe+0x814/0xbf0\n\nIt\u0027s technically possible to create a client after i2c_deregister_clients\nhas run. That client will never be unregistered and make\nwait_for_completion hang.\n\nClose the window by removing the new_device attribute at the start of\ni2c_del_adapter(). device_remove_file() will drain any clients left.",
"id": "GHSA-xr2v-8c9q-cqgw",
"modified": "2026-09-16T12:30:44Z",
"published": "2026-09-16T12:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89983"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/112b3d48084c820bbccf41d9783fd122e3ac4cb0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1f1bcd4eca6caa3e4258d9a31925112539406eb6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/552836be2d95c688eede6371f85532abe1a71232"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/643fb872aa04342d27dbef52b2b3cf3fe71b2c7b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b15b548d52b43ba8ac4652bc2c7244a8dd1e9622"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dc33a9762538b3250ed6b5644a4d44c748be33a6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f9094ace03e0a532cc6505d2e97b61ae738da4ed"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.