In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter deregistration race Adapters can be looked up by their id using i2c_get_adapter() which takes a reference to the embedded struct device. Remove the adapter from the IDR before tearing it down during deregistration (and on registration failure) to make sure its resources are not accessed after having been freed (e.g. the device name).
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64279 is a use-after-free vulnerability in the Linux kernel's i2c subsystem that occurs during adapter deregistration. The flaw arises when adapters can be looked up by ID through i2c_get_adapter(), which obtains a reference to the embedded struct device. If the adapter is removed from the IDR (ID Radix tree) after teardown begins rather than before, concurrent threads may access freed memory resources—particularly the device name and other critical structures. This affects any Linux system using i2c devices (embedded systems, IoT devices, automotive systems, and servers with i2c peripherals), and the race condition could allow local attackers to trigger information disclosure or denial of service through memory corruption.
Casky's security skills leverage Claude AI's extended reasoning to detect the attack patterns underlying kernel race conditions and resource management failures. While this specific CVE lacks mapped MITRE ATT&CK techniques, practitioners using Casky would recognize detection signals aligned with T1499 (Service Exhaustion Denial of Service) through crash patterns, T1005 (Data from Local System) via memory disclosure, and T1562 (Impair Defenses) if exploitation corrupts kernel structures. By analyzing kernel logs, memory access patterns, and i2c subsystem interactions, Casky's skills help teams identify attempts to exploit race windows, detect use-after-free conditions through behavioral anomalies, and pinpoint timing-dependent vulnerabilities that traditional signature-based tools miss—enabling proactive patching before exploitation occurs.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64279. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation