Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89983— i2c: core: fix debugfs UAF on adapter removal

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该Linux内核漏洞描述信息的中文翻译： 在 Linux 内核中，已修复以下漏洞： i2c: core: 修复适配器移除时 debugfs 的释放后使用（UAF）问题 在注销适配器设备之前，会先释放该适配器的 debugfs 目录。然而， 的 sysfs 属性在 执行前仍处于可写状态。如果在移除过程中发生竞态条件（即写入操作与移除操作并发执行），写入操作仍会触达 ，并将已释放的 作为新客户端的父目录传递给 ： 从技术上讲，在 执行之后仍可能创建新的客户端。该客户端永远不会被注销，从而导致 挂起。 为关闭这个竞

AI Predicted 4.8 Difficulty: Moderate EPSS 0.21% · P11

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 19

VendorProduct Version RangeStatus
Linux Linux 0e8926abfd7aee220e44be5566affd7a8580b50e< dc33a9762538b3250ed6b5644a4d44c748be33a6 affected
e2a268b0f512fb18ae5961b1fdfaf610ed6bd661< 1f1bcd4eca6caa3e4258d9a31925112539406eb6 affected
4a2be5a72865bdd219b2d8c327b9fa03e87a4a9e< f9094ace03e0a532cc6505d2e97b61ae738da4ed affected
73febd775bdbdb98c81255ff85773ac410ded5c4< 643fb872aa04342d27dbef52b2b3cf3fe71b2c7b affected
73febd775bdbdb98c81255ff85773ac410ded5c4< 112b3d48084c820bbccf41d9783fd122e3ac4cb0 affected
73febd775bdbdb98c81255ff85773ac410ded5c4< 552836be2d95c688eede6371f85532abe1a71232 affected
73febd775bdbdb98c81255ff85773ac410ded5c4< b15b548d52b43ba8ac4652bc2c7244a8dd1e9622 affected
5.15.168< 5.15.221 affected
… +11 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89983

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
i2c: core: fix debugfs UAF on adapter removal
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix debugfs UAF on adapter removal i2c_del_adapter() frees the adapter's debugfs directory before it unregisters the adapter device, but the new_device sysfs attribute stays writable until device_del(). A write racing with removal still reaches i2c_device_probe(), which passes the freed adap->debugfs to debugfs_create_dir() as the new client's parent: BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430 Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090 lookup_noperm_common+0x407/0x430 simple_start_creating+0x9c/0x110 debugfs_start_creating+0xdb/0x1a0 debugfs_create_dir+0x24/0x350 i2c_device_probe+0x814/0xbf0 It's technically possible to create a client after i2c_deregister_clients has run. That client will never be unregistered and make wait_for_completion hang. Close the window by removing the new_device attribute at the start of i2c_del_adapter(). device_remove_file() will drain any clients left.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 0e8926abfd7aee220e44be5566affd7a8580b50e ~ dc33a9762538b3250ed6b5644a4d44c748be33a6 -
Linux Linux 6.8 -

II. Public POCs for CVE-2026-89983

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89983

请登录查看更多情报信息。

Other References for CVE-2026-89983 (7)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89983

No comments yet

Leave a comment