CVE-2026-80680

The Linux kernel's amd-mp2 PCI driver for AMD's MP2 I2C controller registers a callback pointing to the platform I2C context before the I2C adapter is added; if i2c_add_adapter() fails during probe, the context memory is freed while the PCI driver's IRQ and system-sleep callbacks still hold a stale pointer, resulting in a use-after-free dereference. The flaw is triggered on the probe error path when adapter registration fails, after which any interrupt or system-sleep callback invocation can dereference the dangling pointer, potentially causing kernel memory corruption or a crash. An attacker on the local system could potentially gain denial of service or, per the CVSS scoring (7.8 high, local vector, low privileges), elevated impact through kernel memory corruption. Only Linux systems running on AMD hardware equipped with the MP2 I2C controller, using kernels that include the flawed amd-mp2 driver, are affected. There is no known exploitation in the wild, no public proof-of-concept, and EPSS estimates only a 0.1% probability of exploitation within 30 days.

What to do: Update affected systems to a kernel build that includes the upstream fix, which unregisters the MP2 callback before returning the adapter-registration error; no specific fixed version numbers are available in this data, so check your distribution's kernel advisory. On AMD systems, check dmesg/kernel logs for amd-mp2 or i2c_add_adapter failure messages to identify systems that hit the vulnerable error path. No mitigation is known beyond applying the kernel patch.