CVE-2026-80680

i2c: amd-mp2: Unregister callback on adapter add failure

HIGH

7.8

CVSS Score

Published: August 28, 2026 at 06:52 AM UTC

Updated: August 29, 2026 at 07:16 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2c_add_adapter() fails, probe returns and devres frees the context, but the PCI driver can still dereference the stale pointer from its IRQ and system-sleep callbacks. Unregister the callback before returning the adapter registration error.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.2 ≤ v < 5.10.2655.2 ≤ v < 5.15.2165.2 ≤ v < 6.1.1835.2 ≤ v < 6.12.1035.2 ≤ v < 6.18.445.2 ≤ v < 6.6.1515.2 ≤ v < 7.1.85.2 ≤ v < 7.25.2529766e0a0114438887382a68d97341fbf8349fb

Vendor states this is fixed in 1883a09a37fed497b9efacf736c23624a472246b (fixed)

Vendor states this is fixed in 2f7789b3a9628819ebf90bcba8f9da3c139f8687 (fixed)

Vendor states this is fixed in 4786d4d70dcd1e6b7e044f2348e00f201947b69c (fixed)

Vendor states this is fixed in 82048795242f04275a3f49ffc66ad851b6120954 (fixed)

Vendor states this is fixed in 8bf719659406e4a1b56d441e0c7da2085d891d96 (fixed)

Vendor states this is fixed in 9142a3dcff0d80a3a24ce159aee19ddc869d9784 (fixed)

Vendor states this is fixed in b7c2c5c8868737926410b93d1223ada17625ead3 (fixed)

Vendor states this is fixed in cf107c5983dc70fcf932a305581a5f976d908ff1 (fixed)

Vendor states this is fixed in 5.10.265 (unaffected)

Vendor states this is fixed in 5.15.216 (unaffected)

Vendor states this is fixed in 5.2 (unaffected)

Vendor states this is fixed in 6.1.183 (unaffected)