Cloudanix VulnDB

CVE-2026-98218

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A programming mistake in the Linux kernel could let attackers on the same machine cause crashes or take control when certain hardware adapters fail to register.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Dangling pointer left in atr->adapter[] array after i2c_add_adapter failure causes use-after-free when i2c_atr_del_adapter or cleanup later dereferences the freed channel memory.

Why it matters to the business

Linux-based systems using I2C ATR hardware may experience kernel instability, crashes, or potential local privilege escalation when adapter registration fails, increasing operational risk for embedded and server deployments.

How an attack unfolds

An attacker with local access triggers repeated or concurrent i2c_atr_add_adapter calls that fail inside i2c_add_adapter, leaving the slot pointing at freed memory; subsequent del_adapter or notifier activity then performs use-after-free reads or writes.

How to fix it

Apply the upstream fix that clears the adapter slot on the i2c_add_adapter error path before freeing the channel; rebuild and deploy updated kernel packages containing commit resolving the dangling pointer.

How to confirm the fix worked

Confirm kernel source contains the cleared slot assignment on error path; run regression tests exercising add_adapter failure followed by del_adapter; monitor for -EEXIST reuse errors disappearing.

Typical attack path

  1. Obtain local code execution on target Linux system
  2. Load or trigger I2C ATR device registration under error conditions
  3. Force i2c_add_adapter failure to leave dangling adapter pointer
  4. Invoke i2c_atr_del_adapter or bus cleanup to trigger UAF
  5. Leverage freed memory reuse for arbitrary read/write or control flow hijack

How to detect it

Review kernel logs for i2c_atr_add_adapter failures followed by later crashes or warnings in i2c_atr_del_adapter; inspect dmesg and kdump artifacts for use-after-free reports involving adapter array slots.

  • i2c_atr_add_adapter
  • i2c_atr_del_adapter
  • atr->adapter[chan_id]
  • dangling adapter pointer

What your security team should do

  • Prioritize kernel updates for all systems exposing I2C ATR functionality
  • Audit custom drivers or device trees that register I2C adapters for similar patterns
  • Enable kernel hardening features such as KASAN in test environments to surface UAF during validation
  • Monitor kernel mailing list for related I2C ATR patches

The record

In the Linux kernel, the following vulnerability has been resolved: i2c: atr: fix dangling adapter pointer on add failure i2c_atr_add_adapter() stores atr->adapter[chan_id] before i2c_add_adapter() so that the I2C bus notifier can match child clients during registration. On failure the channel is freed but the slot was left pointing at freed memory, which can lead to use-after-free in i2c_atr_del_adapter() / cleanup and also block reuse with -EEXIST. Clear the slot on the i2c_add_adapter() error path before freeing chan.

Affected packages

Ecosystem Package Introduced Fixed