CVE-2026-99001 (GCVE-0-2026-99001)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:20 – Updated: 2026-10-23 12:20
VLAI
Title
drm/xe/i2c: cancel the client work on remove
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xe_i2c_notifier() stores the DesignWare adapter in i2c->adapter and schedules i2c->work when the adapter is registered under the xe I2C platform device, and xe_i2c_client_work() then instantiates the AMC client device on that adapter. xe_i2c_remove() tears down the AMC, unregisters the client devices, the bus notifier and the adapter platform device, but it never drains i2c->work. A work item that is still queued or running when the adapter is unregistered dereferences i2c->adapter in i2c_new_client_device() after platform_device_unregister() has released the adapter. The work item is also embedded in the devm-allocated struct xe_i2c, so a work item still queued after the drm device devm unwind frees that allocation runs its callback on freed memory. The bus notifier is the only thing that schedules this work, and it is unregistered after the client devices. An instance that is still queued when the teardown runs can therefore write i2c->client[XE_I2C_CLIENT_AMC] while the loop is unregistering and clearing the same array, and an AMC client it instantiates late is only cleaned up by the adapter's own child sweep in i2c_del_adapter(). Move bus_unregister_notifier() in front of the client teardown loop and cancel the work right after it, so no new instance can be scheduled and a queued instance is drained before the client array is touched. A running instance still finds a live adapter, since the adapter is unregistered later. (cherry picked from commit a23f27d5ec11c3f418c5e5531eea34ccda2b5b20)
Severity
No CVSS data available.
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7056 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f0e53aadd702c64b2c2090996751c9be043f9e80 , < 2efa187fd4c9b8d7edcae0c1acf46739ce39fd01 (git)
Affected: f0e53aadd702c64b2c2090996751c9be043f9e80 , < 175d654cd48320ad52d0f82dc3f4e3c063c3c5ca (git)
Affected: f0e53aadd702c64b2c2090996751c9be043f9e80 , < 611857adc9e7b0ee1239a0baf38498922ca5a12e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.18.58 , ≤ 6.18.* (semver)
Unaffected: 7.2.11 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_i2c.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2efa187fd4c9b8d7edcae0c1acf46739ce39fd01",
              "status": "affected",
              "version": "f0e53aadd702c64b2c2090996751c9be043f9e80",
              "versionType": "git"
            },
            {
              "lessThan": "175d654cd48320ad52d0f82dc3f4e3c063c3c5ca",
              "status": "affected",
              "version": "f0e53aadd702c64b2c2090996751c9be043f9e80",
              "versionType": "git"
            },
            {
              "lessThan": "611857adc9e7b0ee1239a0baf38498922ca5a12e",
              "status": "affected",
              "version": "f0e53aadd702c64b2c2090996751c9be043f9e80",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_i2c.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.58",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/i2c: cancel the client work on remove\n\nxe_i2c_notifier() stores the DesignWare adapter in i2c-\u003eadapter and\nschedules i2c-\u003ework when the adapter is registered under the xe I2C\nplatform device, and xe_i2c_client_work() then instantiates the AMC\nclient device on that adapter.\n\nxe_i2c_remove() tears down the AMC, unregisters the client devices,\nthe bus notifier and the adapter platform device, but it never drains\ni2c-\u003ework. A work item that is still queued or running when the\nadapter is unregistered dereferences i2c-\u003eadapter in\ni2c_new_client_device() after platform_device_unregister() has\nreleased the adapter. The work item is also embedded in the\ndevm-allocated struct xe_i2c, so a work item still queued after the\ndrm device devm unwind frees that allocation runs its callback on\nfreed memory.\n\nThe bus notifier is the only thing that schedules this work, and it is\nunregistered after the client devices. An instance that is still queued\nwhen the teardown runs can therefore write\ni2c-\u003eclient[XE_I2C_CLIENT_AMC] while the loop is unregistering and\nclearing the same array, and an AMC client it instantiates late is only\ncleaned up by the adapter\u0027s own child sweep in i2c_del_adapter().\n\nMove bus_unregister_notifier() in front of the client teardown loop\nand cancel the work right after it, so no new instance can be\nscheduled and a queued instance is drained before the client array is\ntouched. A running instance still finds a live adapter, since the\nadapter is unregistered later.\n\n(cherry picked from commit a23f27d5ec11c3f418c5e5531eea34ccda2b5b20)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:20:21.753Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2efa187fd4c9b8d7edcae0c1acf46739ce39fd01"
        },
        {
          "url": "https://git.kernel.org/stable/c/175d654cd48320ad52d0f82dc3f4e3c063c3c5ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/611857adc9e7b0ee1239a0baf38498922ca5a12e"
        }
      ],
      "title": "drm/xe/i2c: cancel the client work on remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99001",
    "datePublished": "2026-10-23T12:20:21.753Z",
    "dateReserved": "2026-09-25T10:25:14.385Z",
    "dateUpdated": "2026-10-23T12:20:21.753Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-99001",
      "date": "2026-10-24",
      "epss": "0.00206",
      "percentile": "0.10166"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/xe/xe_i2c.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2efa187fd4c9b8d7edcae0c1acf46739ce39fd01",
                    "status": "affected",
                    "version": "f0e53aadd702c64b2c2090996751c9be043f9e80",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "175d654cd48320ad52d0f82dc3f4e3c063c3c5ca",
                    "status": "affected",
                    "version": "f0e53aadd702c64b2c2090996751c9be043f9e80",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "611857adc9e7b0ee1239a0baf38498922ca5a12e",
                    "status": "affected",
                    "version": "f0e53aadd702c64b2c2090996751c9be043f9e80",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/xe/xe_i2c.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.58",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/i2c: cancel the client work on remove\n\nxe_i2c_notifier() stores the DesignWare adapter in i2c-\u003eadapter and\nschedules i2c-\u003ework when the adapter is registered under the xe I2C\nplatform device, and xe_i2c_client_work() then instantiates the AMC\nclient device on that adapter.\n\nxe_i2c_remove() tears down the AMC, unregisters the client devices,\nthe bus notifier and the adapter platform device, but it never drains\ni2c-\u003ework. A work item that is still queued or running when the\nadapter is unregistered dereferences i2c-\u003eadapter in\ni2c_new_client_device() after platform_device_unregister() has\nreleased the adapter. The work item is also embedded in the\ndevm-allocated struct xe_i2c, so a work item still queued after the\ndrm device devm unwind frees that allocation runs its callback on\nfreed memory.\n\nThe bus notifier is the only thing that schedules this work, and it is\nunregistered after the client devices. An instance that is still queued\nwhen the teardown runs can therefore write\ni2c-\u003eclient[XE_I2C_CLIENT_AMC] while the loop is unregistering and\nclearing the same array, and an AMC client it instantiates late is only\ncleaned up by the adapter\u0027s own child sweep in i2c_del_adapter().\n\nMove bus_unregister_notifier() in front of the client teardown loop\nand cancel the work right after it, so no new instance can be\nscheduled and a queued instance is drained before the client array is\ntouched. A running instance still finds a live adapter, since the\nadapter is unregistered later.\n\n(cherry picked from commit a23f27d5ec11c3f418c5e5531eea34ccda2b5b20)"
          }
        ],
        "id": "CVE-2026-99001",
        "lastModified": "2026-10-23T13:17:22.440",
        "metrics": {},
        "published": "2026-10-23T13:17:22.440",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/175d654cd48320ad52d0f82dc3f4e3c063c3c5ca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2efa187fd4c9b8d7edcae0c1acf46739ce39fd01"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/611857adc9e7b0ee1239a0baf38498922ca5a12e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.