CVE-2026-89983

A flaw was found in the Linux kernel's I2C subsystem. A race condition during adapter removal allows a local user to cause a Denial of Service (DoS) by crashing or hanging the system. When an I2C adapter is being deleted while a user concurrently creates a device through the sysfs interface, the kernel may access memory that has already been freed. This triggers a use-after-free flaw or prevents cleanup from completing, resulting in a kernel panic or an unrecoverable hang.

A race in the I2C core can allow a write to the new_device sysfs attribute while i2c_del_adapter() is removing the adapter. The adapter debugfs directory may already be freed, but i2c_device_probe() can still pass adap debugfs as the parent to debugfs_create_dir(), producing a debugfs use-after-free reported by KASAN. The same race can also allow a client to be created after client deregistration, which may leave it unregistered and make adapter removal hang. For the CVSS the PR:L is used for the paranoid score because a local process with delegated access to I2C sysfs or device management paths may be able to trigger the race without full host root. The issue is not network reachable and requires local control plane interaction with the I2C adapter. Impact is at least local denial of service via kernel crash or hang and in worst case may allow confidentiality or integrity impact due to kernel use-after-free, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.