CVE-2026-80680

What it actually does

A use-after-free occurs because amd_mp2_register_cb stores a platform I2C context in the MP2 PCI driver's callback table before i2c_add_adapter succeeds; on failure the context is freed by devres but IRQ and system-sleep callbacks can still dereference the stale pointer.

Why it matters to the business

Local attackers may crash the kernel or obtain elevated privileges on affected Linux systems, resulting in denial of service or full host compromise.

How an attack unfolds

An attacker with local access forces an i2c_add_adapter failure for the amd-mp2 driver, leaving a dangling pointer in the PCI callback table; subsequent IRQ or suspend/resume callbacks then dereference the freed memory to achieve use-after-free.

How to fix it

Apply a Linux kernel update that contains the patch unregistering the callback before returning the adapter registration error.

How to confirm the fix worked

Confirm the amd-mp2 driver source contains an explicit unregister call on i2c_add_adapter failure; exercise probe failure paths under debug kernels to verify absence of dangling references.

Typical attack path

1. Obtain local user access on a system using the amd-mp2 I2C driver
2. Trigger conditions that cause i2c_add_adapter to fail during probe
3. Invoke IRQ or system-sleep paths that call into the stale callback entry
4. Exploit the resulting use-after-free for memory corruption or privilege escalation

How to detect it

Review kernel logs and dmesg for amd_mp2 or i2c adapter registration errors followed by crashes; inspect crash dumps for use-after-free signatures involving platform I2C context pointers.

What your security team should do

• Prioritize kernel updates for systems exposing the amd-mp2 driver
• Limit local unprivileged access on multi-user Linux hosts until patched
• Enable kernel hardening features such as KASAN and hardened usercopy during testing