{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64279", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.777Z", "datePublished": "2026-07-25T08:49:23.145Z", "dateUpdated": "2026-09-08T08:50:21.871Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:52:34.328Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: core: fix adapter deregistration race\n\nAdapters can be looked up by their id using i2c_get_adapter() which\ntakes a reference to the embedded struct device.\n\nRemove the adapter from the IDR before tearing it down during\nderegistration (and on registration failure) to make sure its resources\nare not accessed after having been freed (e.g. the device name)."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - An attacker reaches the vulnerable lookup through local open/openat calls on /dev/i2c-N and can trigger dynamic-adapter teardown through local usbfs ioctls. No network path directly reaches i2c_get_adapter().\nAC:L - An attacker with access to both device nodes can control both sides by racing parallel I2C opens against repeatable USBDEVFS_DISCONNECT and rebind operations. No victim-controlled timing or uncontrollable condition is required.\nPR:L - i2cdev_open() and the usbfs disconnect path impose device-node DAC, LSM, and device-cgroup checks but no capability requirement. A regular user granted I2C and USB-device access can trigger the race without init-namespace root.\nUI:N - The attacker can initiate the adapter lookup, software disconnect, and subsequent stale-adapter operations directly. No separate victim action is required.\nS:U - Exploitation corrupts or executes code within the same host kernel security authority. This is ordinary local kernel privilege escalation rather than a VM, IOMMU, or other scope-boundary escape.\nC:H - The race can return an adapter after its embedded device resources have been released, followed by freeing of the enclosing dynamic-adapter allocation. Reclaiming this heap object permits attacker-influenced pointer dereferences and potential arbitrary kernel-memory disclosure.\nI:H - The stale adapter contains algorithm and locking function pointers, while I2C ioctls also write mutable adapter fields. Heap reclamation can therefore provide memory-corruption and control-flow-hijacking primitives leading to kernel code execution.\nA:H - Refcount resurrection, stale device-resource accesses, and dereferences through a freed adapter can produce kernel warnings, oopses, or panics. An attacker controlling disconnect and rebind can repeat the trigger."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i2c/i2c-core-base.c"], "versions": [{"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "lessThan": "d39282f552dd6c35b9b84b4af78f1198c24f3373", "status": "affected", "versionType": "git"}, {"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "lessThan": "11dfa37bf544cc806f21742ca2fd2d841bd7032e", "status": "affected", "versionType": "git"}, {"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "lessThan": "9882a9bd74db08e7bae5821a7050627ae92d3380", "status": "affected", "versionType": "git"}, {"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "lessThan": "bb234487a447a99315add1b46aa57b72e163e1eb", "status": "affected", "versionType": "git"}, {"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "lessThan": "b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3", "status": "affected", "versionType": "git"}, {"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "lessThan": "35dbd1f1f603401155cbd3a180bb18e3a3b675b8", "status": "affected", "versionType": "git"}, {"version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "lessThan": "b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i2c/i2c-core-base.c"], "versions": [{"version": "2.6.31", "status": "affected"}, {"version": "0", "lessThan": "2.6.31", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d39282f552dd6c35b9b84b4af78f1198c24f3373"}, {"url": "https://git.kernel.org/stable/c/11dfa37bf544cc806f21742ca2fd2d841bd7032e"}, {"url": "https://git.kernel.org/stable/c/9882a9bd74db08e7bae5821a7050627ae92d3380"}, {"url": "https://git.kernel.org/stable/c/bb234487a447a99315add1b46aa57b72e163e1eb"}, {"url": "https://git.kernel.org/stable/c/b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3"}, {"url": "https://git.kernel.org/stable/c/35dbd1f1f603401155cbd3a180bb18e3a3b675b8"}, {"url": "https://git.kernel.org/stable/c/b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f"}], "title": "i2c: core: fix adapter deregistration race", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-09-08T08:50:21.871Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/i2c/i2c-core-base.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d39282f552dd6c35b9b84b4af78f1198c24f3373", "status": "affected", "version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "versionType": "git"}, {"lessThan": "11dfa37bf544cc806f21742ca2fd2d841bd7032e", "status": "affected", "version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "versionType": "git"}, {"lessThan": "9882a9bd74db08e7bae5821a7050627ae92d3380", "status": "affected", "version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "versionType": "git"}, {"lessThan": "bb234487a447a99315add1b46aa57b72e163e1eb", "status": "affected", "version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "versionType": "git"}, {"lessThan": "b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3", "status": "affected", "version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "versionType": "git"}, {"lessThan": "35dbd1f1f603401155cbd3a180bb18e3a3b675b8", "status": "affected", "version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "versionType": "git"}, {"lessThan": "b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f", "status": "affected", "version": "35fc37f8188177e3ba3e7f99a6e3300e490e9181", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/i2c/i2c-core-base.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.31"}, {"lessThan": "2.6.31", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE528008-C559-4313-A979-99A5D04AE74B", "versionEndExcluding": "5.15.212", "versionStartIncluding": "2.6.31", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20", "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE", "versionEndExcluding": "6.6.145", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2", "versionEndExcluding": "6.12.96", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: core: fix adapter deregistration race\n\nAdapters can be looked up by their id using i2c_get_adapter() which\ntakes a reference to the embedded struct device.\n\nRemove the adapter from the IDR before tearing it down during\nderegistration (and on registration failure) to make sure its resources\nare not accessed after having been freed (e.g. the device name)."}], "id": "CVE-2026-64279", "lastModified": "2026-09-08T09:18:17.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-25T10:17:08.437", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/11dfa37bf544cc806f21742ca2fd2d841bd7032e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/35dbd1f1f603401155cbd3a180bb18e3a3b675b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9882a9bd74db08e7bae5821a7050627ae92d3380"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bb234487a447a99315add1b46aa57b72e163e1eb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d39282f552dd6c35b9b84b4af78f1198c24f3373"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: i2c: core: fix adapter deregistration race", "id": "2507156", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507156"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel, specifically within its I2C (Inter-Integrated Circuit) core component. This vulnerability involves a race condition that occurs when an I2C adapter is being removed from the system. During this process, it is possible for the system to attempt to access the adapter's memory after it has already been released. A local attacker could potentially exploit this issue, leading to system instability, unauthorized information access, or the execution of malicious code."], "name": "CVE-2026-64279", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "impact": "important", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "impact": "important", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "impact": "important", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "impact": "important", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "impact": "important", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "impact": "important", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "impact": "important", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "impact": "important", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64279\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64279\nhttps://lore.kernel.org/linux-cve-announce/2026072501-CVE-2026-64279-0cd1@gregkh/T"], "threat_severity": "Moderate"}