CVE-2026-89982 i2c: mux: Fix channel node leak on adapter add failure
A memory leak in the Linux kernel i2c mux driver can cause resource exhaustion and denial of service when adapter registration fails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89982?
CVE-2026-89982 is a memory corruption vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
i2c: mux: Fix channel node leak on adapter add failure
i2c_mux_add_adapter() takes a reference to the Device Tree channel node before registering the new adapter. If adapter registration fails, the error path frees the private data without dropping that reference.
Release the channel node before freeing the private data.
Which versions are affected by CVE-2026-89982?
How do I fix CVE-2026-89982?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89982 being exploited?
There is no known exploitation of CVE-2026-89982 in the wild and no public exploit code.
Sources
Also known as AZL-101267, BELL-CVE-2026-89982, DEBIAN-CVE-2026-89982, GHSA-qwmr-87j6-fh8c, UBUNTU-CVE-2026-89982.