Skip to main content

Linux Kernel CVE-2026-53400

| EUVDEUVD-2026-45455 HIGH
Race Condition (CWE-362)
2026-07-19 Linux GHSA-9p96-44q4-p2j5
Linux Information Disclosure Race Condition
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local trigger (AV:L) needing low privilege (PR:L); the narrow registration race window justifies AC:H, and a kernel UAF plausibly yields full CIA impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:27 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 12:02 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

i2c: core: fix adapter registration race

Adapters can be looked up based on their id using i2c_get_adapter() which takes a reference to the embedded struct device.

Make sure that the adapter (including its struct device) has been initialised before adding it to the IDR to avoid accessing uninitialised data which could, for example, lead to NULL-pointer dereferences or use-after-free.

Note that the i2c-dev chardev, which is registered from a bus notifier, currently uses i2c_get_adapter() so the adapter needs to be added to the IDR before registration.

AnalysisAI

Local privilege escalation and denial of service in the Linux kernel's I2C core subsystem arises because an I2C adapter is added to the global IDR lookup table before its embedded struct device is fully initialised. Because i2c_get_adapter() and the i2c-dev chardev (registered via a bus notifier) can look up an adapter by id and take a reference to that device during this window, a concurrent caller can access uninitialised data, leading to NULL-pointer dereference or use-after-free. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the fix has been merged and backported across stable trees.

Technical ContextAI

The bug lives in the kernel I2C core (drivers/i2c/i2c-core-base.c), which manages struct i2c_adapter objects. Each adapter embeds a struct device and is registered into an IDR (ID radix tree) so consumers can resolve it by numeric adapter id via i2c_get_adapter(), which increments the device refcount. The defect is an ordering/registration race: the adapter was inserted into the IDR before device initialisation/registration completed, so a parallel lookup could dereference a partially constructed device. This is a classic concurrency root cause (CWE-362 race condition) that manifests as CWE-416 use-after-free or a NULL-pointer dereference (CWE-476). The i2c-dev character device is especially relevant because it is created from a bus notifier and itself calls i2c_get_adapter(), so the fix required the adapter to be present in the IDR before that registration - the patch reorders initialisation so the device is fully set up prior to IDR insertion. The kernel-provided CWE field is N/A, so the weakness classes above are inferred from the description.

RemediationAI

The primary fix is to upgrade to a patched stable kernel: vendor-released patch versions are 6.12.95, 7.1.3, 6.18.38, and 7.2-rc1 depending on your branch, or apply the corresponding upstream stable commits (78793c75dc6d0ff2e4d50ad617349b328a99054e, 6a946038f2a5a8c29048c6af369d4e391448a5c5, a4c8094bbf4c6fa68b17e3b16f6a0a1b7a14f3e0, ba14d7cf2fe7284610a29854bdff22b2537d3ce6) referenced at git.kernel.org, and track your distribution's backport advisory keyed to CVE-2026-53400 (https://nvd.nist.gov/vuln/detail/CVE-2026-53400). There is no functional runtime workaround because the race is internal to adapter registration; as a compensating control you can reduce exposure by limiting which local users can reach the I2C interfaces - for example restricting permissions on /dev/i2c-* device nodes and unloading or blacklisting unnecessary I2C bus and i2c-dev modules so untrusted local processes cannot trigger adapter lookups, accepting the trade-off that this removes legitimate userspace I2C access on those systems. Prioritise the patch over the workaround, since the mitigations only narrow, not close, the timing window.

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2015-5754 CRITICAL POC
9.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-53400 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy