CVE-2026-64279

A flaw was found in the Linux kernel, specifically within its I2C (Inter-Integrated Circuit) core component. This vulnerability involves a race condition that occurs when an I2C adapter is being removed from the system. During this process, it is possible for the system to attempt to access the adapter's memory after it has already been released. A local attacker could potentially exploit this issue, leading to system instability, unauthorized information access, or the execution of malicious code.

This flaw has been rated as Moderate in severity by Red Hat because triggering the condition requires local access and depends on winning a tight timing window during device teardown. Although concurrent access to a deallocating I2C bus adapter can lead to a use-after-free and crash the operating system, obtaining arbitrary code execution is difficult in practice. Additionally, dynamic unloading or removal of I2C hardware adapters is uncommon under standard enterprise deployment scenarios, significantly reducing operational exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.