A race condition (CWE-362) in the Linux kernel’s i2c core allows an adapter that has been deregistered to still be referenced through its ID. Because the adapter was not removed from the IDR during teardown or register failure, code paths can access freed resources such as the device name, leading to use‑after‑free, memory corruption, kernel oops, or a system crash. The race can also lead to unintended resource deallocation and premature freeing of memory, which may be interpreted as a resource exhaustion scenario (CWE-367).

All Linux kernel distributions running a kernel version that does not include the commit sequence referenced in the advisory are affected. The vulnerability exists in the kernel itself and therefore applies to every vendor’s kernel releases prior to those changes.

The CVSS score is 7.8 and the EPSS score is reported as < 1 %, indicating a low probability of widespread exploitation. The vulnerability is not catalogued in the CISA KEV list. This vulnerability is classified as both a Race Condition (CWE-362) and Resource Exhaustion (CWE-367). Based on the description, it is inferred that attacking this flaw would require local access and the ability to interact with i2c devices or load kernel modules that register adapters, which could trigger the race and cause a denial‑of-service or kernel crash.