Description

In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2c_add_adapter() fails, probe returns and devres frees the context, but the PCI driver can still dereference the stale pointer from its IRQ and system-sleep callbacks. Unregister the callback before returning the adapter registration error.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-28T08:16:53.350Z",
  "pubdate": "2026-08-28T08:16:53.350Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel's amd-mp2 driver due to improper resource management during device initialization.\nThe vulnerability occurs when the amd_mp2_register_cb() function stores a reference to a platform I2C context in the driver's callback table before the successful registration of the I2C adapter.\nIf i2c_add_adapter() fails during the probe process, the context is freed by devres, but the stale pointer remains within the callback table used by the PCI driver's IRQ and system-sleep handlers.\nSuccessful exploitation allows an attacker to trigger a kernel panic or potentially execute arbitrary code through the dereferencing of a freed memory pointer.\nThis vulnerability affects the Linux kernel's amd-mp2 driver, exposing systems using AMD MP2 I2C controllers to local denial-of-service and potential privilege escalation attacks.\nExploitation requires the attacker to be capable of triggering the probe failure condition, typically through system resource exhaustion or hardware state manipulation.",
  "technicalDetails": "The root cause of this vulnerability lies in a race condition and improper error handling within the amd-mp2 driver's probe sequence. The driver function amd_mp2_register_cb() registers an I2C context pointer into the MP2 PCI driver's global callback table prematurely, specifically before verifying that the underlying I2C adapter has been successfully initialized and registered via i2c_add_adapter().\nWhen i2c_add_adapter() fails, the driver's probe function returns an error code. Because the memory associated with the I2C context is managed by devres (Device Resource Management), the memory is automatically released upon the probe function's exit. However, the reference previously stored in the PCI driver's callback table is not cleared, resulting in a dangling pointer.\nThe vulnerability is triggered when the PCI driver subsequently invokes functions that access this callback table, such as those registered for interrupt handling (IRQ) or system-sleep power management transitions. Since the pointers stored in the table now point to memory that has already been deallocated by the kernel's memory allocator, any access by the CPU to these locations results in a use-after-free (UAF) condition.\nIn a post-exploitation scenario, this UAF can be leveraged by an attacker to induce a kernel crash or manipulate kernel state. If the freed memory is reallocated by the kernel for another structure before the stale pointer is dereferenced, the attacker may be able to influence the new contents of that memory, potentially leading to arbitrary code execution if the dereference involves a function pointer call.\nThe exposure is local, requiring the attacker to trigger a condition where the probe of the amd-mp2 driver fails (e.g., through malicious manipulation of the hardware state or system environment). Once the stale pointer is left in the callback table, any subsequent event—such as a power state change or a hardware interrupt—will trigger the dereference of the dangling pointer, completing the exploit chain."
}