CVE-2026-74463: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock

Published Aug 15, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

i2c: jz4780: Cache host clock rate at probe to prevent CCF preparelock deadlock

Fix a severe AB/BA deadlock between the Common Clock Framework (CCF) and the I2C adapter lock, which triggers when an I2C-controlled clock generator client (like the Si5351) is registered or modified under the CCF.

During an i2c client clock (generator) frequency change, the CCF acquires its global 'preparelock' mutex and the driver calls i2ctransfer() to update the client's chip registers, stalling for the adapter's I2C bus lock.

Concurrently, an independent, parallel transfer on the same bus (e.g., a GPIO expander handling LEDs) can hold the I2C adapter lock. Inside this parallel transfer path, jz4780i2csetspeed() calls clkgetrate() on the host controller's input clock to calculate bus timings. This call attempts to acquire the blocked CCF 'preparelock', creating a circular dependency that freezes the system.

The jz4780 host controller clock itself is static and never changes at runtime.

However, calling clkgetrate() inside the active transfer path introduces an unnecessary dependency on the CCF internal locks.

Eliminate this synchronous clkgetrate() call from the active transfer path by caching the static host peripheral clock rate once - inside the private jz4780i2c structure during jz4780i2cprobe(). Update jz4780i2csetspeed() to use this cached value, safely decoupling active I2C transactions from the CCF internal locks without any risk of stale timings.

Assisted-by web based Google AI (pinpointing the bug and writing the message).

Affected Software

1 affected component
Linux Linux kernel

Event History

Aug 15, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-74463?

CVE-2026-74463 has been classified as a severe vulnerability due to the potential for deadlock situations.

2

How do I fix CVE-2026-74463?

To fix CVE-2026-74463, ensure you update your Linux kernel to the latest version where this vulnerability has been resolved.

3

What systems are affected by CVE-2026-74463?

CVE-2026-74463 affects systems using the Linux kernel with the I2C framework, especially those utilizing the jz4780 I2C adapter.

4

What are the potential impacts of CVE-2026-74463?

The potential impact of CVE-2026-74463 includes system hangs or crashes due to the deadlock between the Common Clock Framework and the I2C adapter.

5

Is there a workaround for CVE-2026-74463?

Currently, there are no documented workarounds for CVE-2026-74463; the recommended solution is to apply the kernel update.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203