Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-80678

i2c: imx: Fix slave registration race and error handling

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.15.217, 6.1.183, 6.6.151, 6.12.103, 6.18.44, and 1 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2c_imx_reg_slave(), the slave pointer was assigned before pm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed, the error path returned without clearing i2c_imx->slave, leaving it non-NULL and causing all subsequent registration attempts to fail with -EBUSY. Additionally, because this driver uses a shared IRQ, the interrupt handler i2c_imx_isr() can execute concurrently and, after acquiring slave_lock, dereference i2c_imx->slave. The previous fix attempt added a lockless i2c_imx->slave = NULL on the error path, but that could race with the ISR under the lock and still cause a NULL pointer dereference. Fix both issues by deferring the assignment of i2c_imx->slave and i2c_imx->last_slave_event to after a successful resume, and by performing the assignment inside the slave_lock critical section. This guarantees that the slave pointer is never left stale on the error path and is always valid when observed by the interrupt handler.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From f7414cd6923fd7f78e57086fc964ba2dc25db5c1 · fixed in 754bc62f72fd64b202462367134ac8ce95b005de; From f7414cd6923fd7f78e57086fc964ba2dc25db5c1 · fixed in cfdf6e13518589f911b7eace6ccb788e4ed87397; From f7414cd6923fd7f78e57086fc964ba2dc25db5c1 · fixed in b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8; From f7414cd6923fd7f78e57086fc964ba2dc25db5c1 · fixed in d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f; From f7414cd6923fd7f78e57086fc964ba2dc25db5c1 · fixed in 12a4f0950a158d98552cbaeacc35edccd8d975fa; From f7414cd6923fd7f78e57086fc964ba2dc25db5c1 · fixed in 614ca6594e301ff682999797c2216e9685558a2b; From f7414cd6923fd7f78e57086fc964ba2dc25db5c1 · fixed in d64ec362c369bbc33833f7936d5f3a706b0d5c45

  • Linux Linux

    5.11

  • KernelLinux

    From 5.11.0 · fixed in 5.15.217; From 5.16.0 · fixed in 6.1.183; From 6.2.0 · fixed in 6.6.151; From 6.7.0 · fixed in 6.12.103; From 6.13.0 · fixed in 6.18.44; From 6.19.0 · fixed in 7.1.8

References 7

git.kernel.org