What is the CVSS score of CVE-2026-53400?

CVE-2026-53400 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-53400?

Within 24 hours, identify all systems running Linux kernels in your environment and determine which versions are affected by CVE-2026-53400 by consulting vendor security advisories and scanning your infrastructure inventory. Within 7 days, deploy kernel patches to non-production systems (development, staging, testing) to validate compatibility with your applications and services before production rollout. Within 30 days, complete patch deployment to all production systems according to your change management process, prioritizing critical infrastructure and systems handling sensitive data; coordinate maintenance windows to minimize business disruption.

Linux Kernel CVE-2026-53400

Q: Which versions of Linux Kernel are affected by CVE-2026-53400?

The Linux kernel contains a local privilege escalation flaw (CVE-2026-53400) that allows unprivileged users to gain elevated system access or cause system outages.. A patch is available.

EUVD-2026-45455 HIGH

Race Condition (CWE-362)

2026-07-19 Linux

GHSA-9p96-44q4-p2j5

Information Disclosure Linux Race Condition

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain low-privileged local shell
Delivery

Open /dev/i2c-* to invoke i2c_get_adapter()
Exploit

Race concurrent adapter IDR registration
Execution

Dereference uninitialised/freed device
Persist

Kernel crash or memory corruption
Impact

Denial of service or privilege escalation

Vulnerability Assessment

Weakness	CWE CWE-362 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V15 - Secure Coding and Architecture Concurrency control, locking MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires local access to a Linux host where the I2C subsystem is active and reachable from the attacker's context - specifically the presence of i2c-dev and I2C bus adapters, and the ability to invoke an adapter lookup (via i2c_get_adapter() paths such as opening /dev/i2c-* nodes) concurrently with an adapter being registered. The exploitable window exists only during adapter registration, which typically occurs at boot, kernel-module load, or hardware hotplug rather than continuously, so an attacker must either induce or wait for such an event and win a tight race - this timing constraint is the principal limiting factor. It is not remotely exploitable (CVSS AV:L) and per PR:L requires at least low-privileged local execution; systems with I2C modules absent or /dev/i2c-* access restricted are not practically exposed.
Impact	The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 7.8) reflects a local, low-privilege flaw with full CIA impact typical of kernel memory-corruption entries, but several signals suggest the practical risk is lower than the 7.8 implies. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so this is not a confirmed exploitation priority. Most importantly, the AC:L rating is questionable: the vulnerability is a registration-time race with a narrow timing window an attacker must win, and I2C adapter registration generally occurs at boot, driver load, or hardware hotplug rather than on demand from an unprivileged process - factors that argue for higher attack complexity and constrained triggerability. Realistically this is a defense-in-depth hardening fix affecting reliability and theoretical local escalation more than an actively weaponisable bug; treat it as routine stable-kernel patch hygiene rather than an emergency.
Exploit ScenarioDerived	A local unprivileged user on a system that exposes I2C interfaces repeatedly opens or probes i2c-dev nodes while an adapter is being registered (for example during driver load or a hotplug event), racing i2c_get_adapter() against the incomplete device initialisation. Winning the race dereferences uninitialised or freed device memory, crashing the kernel (DoS) or, with careful heap grooming, corrupting kernel memory toward privilege escalation. No public POC is referenced, and the narrow timing window makes reliable exploitation difficult.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Local privilege escalation and denial of service in the Linux kernel's I2C core subsystem arises because an I2C adapter is added to the global IDR lookup table before its embedded struct device is fully initialised. Because i2c_get_adapter() and the i2c-dev chardev (registered via a bus notifier) can look up an adapter by id and take a reference to that device during this window, a concurrent caller can access uninitialised data, leading to NULL-pointer dereference or use-after-free. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the fix has been merged and backported across stable trees.

RemediationAI

The primary fix is to upgrade to a patched stable kernel: vendor-released patch versions are 6.12.95, 7.1.3, 6.18.38, and 7.2-rc1 depending on your branch, or apply the corresponding upstream stable commits (78793c75dc6d0ff2e4d50ad617349b328a99054e, 6a946038f2a5a8c29048c6af369d4e391448a5c5, a4c8094bbf4c6fa68b17e3b16f6a0a1b7a14f3e0, ba14d7cf2fe7284610a29854bdff22b2537d3ce6) referenced at git.kernel.org, and track your distribution's backport advisory keyed to CVE-2026-53400 (https://nvd.nist.gov/vuln/detail/CVE-2026-53400). There is no functional runtime workaround because the race is internal to adapter registration; as a compensating control you can reduce exposure by limiting which local users can reach the I2C interfaces - for example restricting permissions on /dev/i2c-* device nodes and unloading or blacklisting unnecessary I2C bus and i2c-dev modules so untrusted local processes cannot trigger adapter lookups, accepting the trade-off that this removes legitimate userspace I2C access on those systems. Prioritise the patch over the workaround, since the mitigations only narrow, not close, the timing window.

Affected VersionsENISA

Linux patch: 6.18.38

Linux 6e13e641841833cc2aa5baefe89bb04bc388801b <ba14d7cf2fe7284610a29854bdff22b2537d3ce6

Linux patch: 7.2-rc1

Linux 6e13e641841833cc2aa5baefe89bb04bc388801b <6a946038f2a5a8c29048c6af369d4e391448a5c5

Linux patch: 0

Linux patch: 7.1.3

Linux patch: 6.12.95

Linux 6e13e641841833cc2aa5baefe89bb04bc388801b <78793c75dc6d0ff2e4d50ad617349b328a99054e

Linux 6e13e641841833cc2aa5baefe89bb04bc388801b <a4c8094bbf4c6fa68b17e3b16f6a0a1b7a14f3e0

Linux 2.6.22

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The bug lives in the kernel I2C core (drivers/i2c/i2c-core-base.c), which manages struct i2c_adapter objects. Each adapter embeds a struct device and is registered into an IDR (ID radix tree) so consumers can resolve it by numeric adapter id via i2c_get_adapter(), which increments the device refcount. The defect is an ordering/registration race: the adapter was inserted into the IDR before device initialisation/registration completed, so a parallel lookup could dereference a partially constructed device. This is a classic concurrency root cause (CWE-362 race condition) that manifests as CWE-416 use-after-free or a NULL-pointer dereference (CWE-476). The i2c-dev character device is especially relevant because it is created from a bus notifier and itself calls i2c_get_adapter(), so the fix required the adapter to be present in the IDR before that registration - the patch reorders initialisation so the device is fully set up prior to IDR insertion. The kernel-provided CWE field is N/A, so the weakness classes above are inferred from the description.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.0 HIGH

Local trigger (AV:L) needing low privilege (PR:L); the narrow registration race window justifies AC:H, and a kernel UAF plausibly yields full CIA impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 14:17 EUVD

CVE Published

Jul 19, 2026 - 12:02 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 12:02 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

i2c: core: fix adapter registration race

Adapters can be looked up based on their id using i2c_get_adapter() which takes a reference to the embedded struct device.

Make sure that the adapter (including its struct device) has been initialised before adding it to the IDR to avoid accessing uninitialised data which could, for example, lead to NULL-pointer dereferences or use-after-free.

Note that the i2c-dev chardev, which is registered from a bus notifier, currently uses i2c_get_adapter() so the adapter needs to be added to the IDR before registration.

Executive ViewAI

Why It Matters

The Linux kernel contains a local privilege escalation flaw (CVE-2026-53400) that allows unprivileged users to gain elevated system access or cause system outages. This affects all Linux systems across your organization and poses insider threat risk or exposure if user accounts are compromised. Vendor patches are available; immediate deployment across your Linux fleet eliminates this vulnerability.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Prevalence

Ubiquitous

Linux kernel I2C core present across virtually all Linux deployments

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Same weakness CWE-362 – Race Condition

View all

CVE-2023-36884 HIGH POC

7.5

CVE-2016-5195 HIGH POC

7.0

CVE-2017-1000112 HIGH POC

7.0

CVE-2014-0196 MEDIUM POC

5.5

CVE-2014-0226 MEDIUM POC

6.8

CVE-2016-1757 HIGH POC

7.0

CVE-2016-8655 HIGH POC

7.8

CVE-2025-39964 MEDIUM POC

5.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back