Strix
63.6K

CVE-2026-80680

HIGHCVSS 7.8/10EPSS 0.18%

Last modified

CVE-2026-80680 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2c_add_adapter() fails, probe returns and devres frees the context, but the PCI driver can still dereference the stale pointer from its IRQ and system-sleep callbacks. Unregister the callback before returning the adapter registration error.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2c_add_adapter() fails, probe returns and devres frees the context, but the PCI driver can still dereference the stale pointer from its IRQ and system-sleep callbacks. Unregister the callback before returning the adapter registration error.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.18%

7.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 529766e0a0114438887382a68d97341fbf8349fb, < 9142a3dcff0d80a3a24ce159aee19ddc869d9784; >= 529766e0a0114438887382a68d97341fbf8349fb, < 2f7789b3a9628819ebf90bcba8f9da3c139f8687; >= 529766e0a0114438887382a68d97341fbf8349fb, < 4786d4d70dcd1e6b7e044f2348e00f201947b69c; >= 529766e0a0114438887382a68d97341fbf8349fb, < b7c2c5c8868737926410b93d1223ada17625ead3; >= 529766e0a0114438887382a68d97341fbf8349fb, < cf107c5983dc70fcf932a305581a5f976d908ff1; >= 529766e0a0114438887382a68d97341fbf8349fb, < 1883a09a37fed497b9efacf736c23624a472246b; >= 529766e0a0114438887382a68d97341fbf8349fb, < 8bf719659406e4a1b56d441e0c7da2085d891d96; >= 529766e0a0114438887382a68d97341fbf8349fb, < 82048795242f04275a3f49ffc66ad851b6120954
LinuxLinux5.2

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-80680?
In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amd_mp2_register_cb() stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2c_add_adapter() fails, probe returns and devres frees the context, but the PCI driver can still dereference the stale pointer from its IRQ and system-sleep callbacks. Unregister the callback before returning the adapter registration error.
How severe is CVE-2026-80680?
CVE-2026-80680 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.
How do I fix CVE-2026-80680?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-80680?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST