CVE-2026-64589 i2c: core: fix NULL-deref on adapter registration failure
A NULL pointer dereference in the Linux kernel i2c core can cause a denial of service if adapter registration fails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64589?
CVE-2026-64589 is a vulnerability in Linux, published on 6 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
i2c: core: fix NULL-deref on adapter registration failure
If adapter registration ever fails the release callback would trigger a NULL-pointer dereference as the completion struct has not been initialised.
Note that before the offending commit this would instead have resulted in a minor memory leak of the adapter name.
Which versions are affected by CVE-2026-64589?
How do I fix CVE-2026-64589?
Apply the vendor's patch.
Is CVE-2026-64589 being exploited?
There is no known exploitation of CVE-2026-64589 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-64589, DEBIAN-CVE-2026-64589, GHSA-g8cm-qf26-vx33, UBUNTU-CVE-2026-64589.