CVE-2026-53400 - Vulnerability Details

- i2c: core: fix adapter registration race

Description

In the Linux kernel, the following vulnerability has been resolved:

i2c: core: fix adapter registration race

Adapters can be looked up based on their id using i2c_get_adapter()
which takes a reference to the embedded struct device.

Make sure that the adapter (including its struct device) has been
initialised before adding it to the IDR to avoid accessing uninitialised
data which could, for example, lead to NULL-pointer dereferences or
use-after-free.

Note that the i2c-dev chardev, which is registered from a bus notifier,
currently uses i2c_get_adapter() so the adapter needs to be added to the
IDR before registration.

Published: 2026-07-19

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability is a race condition in the Linux I2C core. Adapters can be queried by ID before their device structure is fully initialized, which allows access to uninitialized data. The flaw can cause a NULL‑pointer dereference or a use‑after‑free, which may lead to kernel memory corruption or a crash. The impact is a denial of service that can compromise system availability.

Affected Systems

All kernels older than the commit that adds the race‑condition check – notably the kernel revision that introduces the fix in commit 6a946038f2a5a8c29048c6af369d4e391448a5c5 – are vulnerable. Distributions that have not incorporated this patch or an equivalent backport remain at risk.

Risk and Exploitability

With a CVSS score of 7.8 the flaw is high severity, yet the EPSS score is less than 1 %, indicating a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is inferred to require local privileged access or a malicious driver to register I2C devices in such a way that the race condition is triggered, potentially leading to a kernel crash or memory corruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< 2e57c788e71f1763445f812eba4e0b4a2fbd0646
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< a4365bc41baaf67f3a5aa8556d23544e6ec7480a
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< 1febb174815bcae56d73587e99e8f87e02f0784d
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< da9d8d9711f78deebc202d0cffcf577e45ee8621
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< 78793c75dc6d0ff2e4d50ad617349b328a99054e
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< 6a946038f2a5a8c29048c6af369d4e391448a5c5
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< a4c8094bbf4c6fa68b17e3b16f6a0a1b7a14f3e0
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< ba14d7cf2fe7284610a29854bdff22b2537d3ce6

Linux

affected

Version	Status	Constraints
`2.6.22`	affected	—
`0`	unaffected	< 2.6.22
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6e13e641841833cc2aa5baefe89bb04bc388801b,78793c75dc6d0ff2e4d50ad617349b328a99054e)`	affected	code_commit	—
`[6e13e641841833cc2aa5baefe89bb04bc388801b,6a946038f2a5a8c29048c6af369d4e391448a5c5)`	affected	code_commit	—
`[6e13e641841833cc2aa5baefe89bb04bc388801b,a4c8094bbf4c6fa68b17e3b16f6a0a1b7a14f3e0)`	affected	code_commit	—
`[6e13e641841833cc2aa5baefe89bb04bc388801b,ba14d7cf2fe7284610a29854bdff22b2537d3ce6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.22`	affected	semver	—
`[0,2.6.22)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.38,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a release that contains the fix, such as the current stable kernel or a backport of commit 6a946038f2a5a8c29048c6af369d4e391448a5c5.
If a kernel upgrade is not feasible, manually apply the patch that enforces the race‑condition check in the i2c core, ensuring adapters are only added to the IDR after their device structures are fully initialized.
Restrict or disable unnecessary I2C devices and the i2c‑dev character device to reduce the attack surface.

Generated by OpenCVE AI on August 12, 2026 at 09:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00103.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1febb174815bcae56d73587e99e8f87e02f0784d
https://git.kernel.org/stable/c/2e57c788e71f1763445f812eba4e0b4a2fbd0646
https://git.kernel.org/stable/c/6a946038f2a5a8c29048c6af369d4e391448a5c5
https://git.kernel.org/stable/c/78793c75dc6d0ff2e4d50ad617349b328a99054e
https://git.kernel.org/stable/c/a4365bc41baaf67f3a5aa8556d23544e6ec7480a
https://git.kernel.org/stable/c/a4c8094bbf4c6fa68b17e3b16f6a0a1b7a14f3e0
https://git.kernel.org/stable/c/ba14d7cf2fe7284610a29854bdff22b2537d3ce6
https://git.kernel.org/stable/c/da9d8d9711f78deebc202d0cffcf577e45ee8621
https://lore.kernel.org/linux-cve-announce/2026071958-CVE-2026-53400-1a67@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53400
https://www.cve.org/CVERecord?id=CVE-2026-53400

History

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1febb174815bcae56d73587e99e8f87e02f0784d https://git.kernel.org/stable/c/2e57c788e71f1763445f812eba4e0b4a2fbd0646 https://git.kernel.org/stable/c/a4365bc41baaf67f3a5aa8556d23544e6ec7480a https://git.kernel.org/stable/c/da9d8d9711f78deebc202d0cffcf577e45ee8621

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026071958-CVE-2026-53400-1a67@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53400 https://www.cve.org/CVERecord?id=CVE-2026-53400
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2c_get_adapter() which takes a reference to the embedded struct device. Make sure that the adapter (including its struct device) has been initialised before adding it to the IDR to avoid accessing uninitialised data which could, for example, lead to NULL-pointer dereferences or use-after-free. Note that the i2c-dev chardev, which is registered from a bus notifier, currently uses i2c_get_adapter() so the adapter needs to be added to the IDR before registration.
Title		i2c: core: fix adapter registration race
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6a946038f2a5a8c29048c6af369d4e391448a5c5 https://git.kernel.org/stable/c/78793c75dc6d0ff2e4d50ad617349b328a99054e https://git.kernel.org/stable/c/a4c8094bbf4c6fa68b17e3b16f6a0a1b7a14f3e0 https://git.kernel.org/stable/c/ba14d7cf2fe7284610a29854bdff22b2537d3ce6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:02:00.632Z

Updated: 2026-08-17T04:50:52.550Z

Reserved: 2026-06-09T07:44:35.403Z

Link: CVE-2026-53400

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-19T12:16:51.177

Modified: 2026-08-17T05:17:14.807

Link: CVE-2026-53400

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53400 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-12T10:00:01Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object