CVE-2026-53400 - Vulnerability Details

- i2c: core: fix adapter registration race

Description

In the Linux kernel, the following vulnerability has been resolved:

i2c: core: fix adapter registration race

Adapters can be looked up based on their id using i2c_get_adapter()
which takes a reference to the embedded struct device.

Make sure that the adapter (including its struct device) has been
initialised before adding it to the IDR to avoid accessing uninitialised
data which could, for example, lead to NULL-pointer dereferences or
use-after-free.

Note that the i2c-dev chardev, which is registered from a bus notifier,
currently uses i2c_get_adapter() so the adapter needs to be added to the
IDR before registration.

Published: 2026-07-19

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the Linux I2C core allows an adapter to be looked up before its device structure is fully initialized, causing uninitialized data access that can lead to a NULL‑pointer dereference or use‑after‑free. This flaw could corrupt kernel memory or trigger a kernel panic, thereby compromising system availability.

Affected Systems

All Linux kernel versions older than the commit that adds the race‑condition check (e.g., commit 6a946038f2a5a8c29048c6af369d4e391448a5c5) are affected. Distributions that have not applied this commit or an equivalent backport remain vulnerable.

Risk and Exploitability

The vulnerability receives a CVSS score of 7.8, classifying it as high severity, while an EPSS score of less than 1 % indicates low exploitation probability as of the latest assessment. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker with local access could provoke the race condition by manipulating I2C device registration or loading a malicious driver, potentially leading to a kernel crash or memory corruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< 2e57c788e71f1763445f812eba4e0b4a2fbd0646
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< a4365bc41baaf67f3a5aa8556d23544e6ec7480a
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< 1febb174815bcae56d73587e99e8f87e02f0784d
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< da9d8d9711f78deebc202d0cffcf577e45ee8621
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< 78793c75dc6d0ff2e4d50ad617349b328a99054e
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< 6a946038f2a5a8c29048c6af369d4e391448a5c5
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< a4c8094bbf4c6fa68b17e3b16f6a0a1b7a14f3e0
`6e13e641841833cc2aa5baefe89bb04bc388801b`	affected	< ba14d7cf2fe7284610a29854bdff22b2537d3ce6

Linux

affected

Version	Status	Constraints
`2.6.22`	affected	—
`0`	unaffected	< 2.6.22
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6e13e641841833cc2aa5baefe89bb04bc388801b,78793c75dc6d0ff2e4d50ad617349b328a99054e)`	affected	code_commit	—
`[6e13e641841833cc2aa5baefe89bb04bc388801b,6a946038f2a5a8c29048c6af369d4e391448a5c5)`	affected	code_commit	—
`[6e13e641841833cc2aa5baefe89bb04bc388801b,a4c8094bbf4c6fa68b17e3b16f6a0a1b7a14f3e0)`	affected	code_commit	—
`[6e13e641841833cc2aa5baefe89bb04bc388801b,ba14d7cf2fe7284610a29854bdff22b2537d3ce6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.22`	affected	semver	—
`[0,2.6.22)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.38,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a release that contains the fix, such as the current stable kernel or a backport of commit 6a946038f2a5a8c29048c6af369d4e391448a5c5.
If a kernel upgrade is not feasible, manually apply the patch that performs the race‑condition check in the i2c core, ensuring adapters are only added to the IDR after their device structures are fully initialized.
Restrict or disable unnecessary I2C devices and the i2c‑dev character device to reduce the attack surface.

Generated by OpenCVE AI on August 3, 2026 at 02:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00103.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1febb174815bcae56d73587e99e8f87e02f0784d
https://git.kernel.org/stable/c/2e57c788e71f1763445f812eba4e0b4a2fbd0646
https://git.kernel.org/stable/c/6a946038f2a5a8c29048c6af369d4e391448a5c5
https://git.kernel.org/stable/c/78793c75dc6d0ff2e4d50ad617349b328a99054e
https://git.kernel.org/stable/c/a4365bc41baaf67f3a5aa8556d23544e6ec7480a
https://git.kernel.org/stable/c/a4c8094bbf4c6fa68b17e3b16f6a0a1b7a14f3e0
https://git.kernel.org/stable/c/ba14d7cf2fe7284610a29854bdff22b2537d3ce6
https://git.kernel.org/stable/c/da9d8d9711f78deebc202d0cffcf577e45ee8621
https://lore.kernel.org/linux-cve-announce/2026071958-CVE-2026-53400-1a67@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53400
https://www.cve.org/CVERecord?id=CVE-2026-53400

History

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1febb174815bcae56d73587e99e8f87e02f0784d https://git.kernel.org/stable/c/2e57c788e71f1763445f812eba4e0b4a2fbd0646 https://git.kernel.org/stable/c/a4365bc41baaf67f3a5aa8556d23544e6ec7480a https://git.kernel.org/stable/c/da9d8d9711f78deebc202d0cffcf577e45ee8621

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026071958-CVE-2026-53400-1a67@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53400 https://www.cve.org/CVERecord?id=CVE-2026-53400
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2c_get_adapter() which takes a reference to the embedded struct device. Make sure that the adapter (including its struct device) has been initialised before adding it to the IDR to avoid accessing uninitialised data which could, for example, lead to NULL-pointer dereferences or use-after-free. Note that the i2c-dev chardev, which is registered from a bus notifier, currently uses i2c_get_adapter() so the adapter needs to be added to the IDR before registration.
Title		i2c: core: fix adapter registration race
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6a946038f2a5a8c29048c6af369d4e391448a5c5 https://git.kernel.org/stable/c/78793c75dc6d0ff2e4d50ad617349b328a99054e https://git.kernel.org/stable/c/a4c8094bbf4c6fa68b17e3b16f6a0a1b7a14f3e0 https://git.kernel.org/stable/c/ba14d7cf2fe7284610a29854bdff22b2537d3ce6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:02:00.632Z

Updated: 2026-08-05T12:35:39.806Z

Reserved: 2026-06-09T07:44:35.403Z

Link: CVE-2026-53400

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53400 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T02:45:03Z

Weaknesses

CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object