Linux Kernel CVE-2026-80680

Exploitation requires a local user account with at least low-privilege access (PR:L) on a Linux system equipped with an AMD processor that includes the MP2 I2C coprocessor (present in AMD Ryzen and certain EPYC platforms). The i2c-amd-mp2 kernel module must be loaded, which occurs automatically on affected AMD hardware. The critical trigger condition is that i2c_add_adapter() must fail during the driver's probe phase - a non-default error condition that may occur due to hardware fault, resource exhaustion, or forced driver rebind. After probe failure, exploitation depends on a subsequent IRQ delivery or system sleep transition invoking the stale callback pointer before the module is reloaded with a clean state. Exploitation is NOT possible remotely, requires no network access, and cannot occur on systems without AMD MP2 hardware. The error-path dependency is the primary limiting factor reducing real-world exploitability beyond what raw CVSS scores suggest.

The CVSS 7.8 High vector (AV:L/AC:L/PR:L/UI:N, full C/I/A impact) accurately reflects the theoretical ceiling of kernel-level use-after-free exploitation - arbitrary kernel memory corruption can yield privilege escalation or denial of service. However, several factors materially reduce real-world exploitation probability: the EPSS score of 0.18% (7th percentile) signals the security research community assigns very low near-term exploitation likelihood; the vulnerability is absent from CISA KEV, confirming no observed active exploitation; and the attack is hardware-constrained to systems with AMD MP2 I2C controllers (primarily AMD Ryzen laptops and desktops). Triggering the vulnerable path further requires the error condition where i2c_add_adapter() fails during driver probe - a non-default, hardware-dependent failure - followed by an IRQ or sleep event against the stale callback. The CVSS AC:L metric may overstate ease for most environments, as forcing the error path may require specific hardware fault conditions or driver rebind operations. Patches are available across all affected stable branches, so the remediation path is clear and standard kernel update procedures are sufficient.

A local user with low-privileged shell access on an AMD Ryzen laptop running an unpatched kernel triggers or waits for the i2c-amd-mp2 driver probe to encounter an i2c_add_adapter() failure - for example by forcing a driver rebind under fault conditions - causing devres to free the I2C context while the stale callback pointer remains registered in the MP2 PCI driver. When the system subsequently suspends or an I2C interrupt fires, the PCI driver dereferences the freed memory, giving the attacker a kernel use-after-free primitive to escalate privileges or crash the host. No public proof-of-concept exploit code has been identified at time of analysis.