CVE-2026-74463: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
In the Linux kernel, the following vulnerability has been resolved:
i2c: jz4780: Cache host clock rate at probe to prevent CCF preparelock deadlock
Fix a severe AB/BA deadlock between the Common Clock Framework (CCF) and the I2C adapter lock, which triggers when an I2C-controlled clock generator client (like the Si5351) is registered or modified under the CCF.
During an i2c client clock (generator) frequency change, the CCF acquires its global 'preparelock' mutex and the driver calls i2ctransfer() to update the client's chip registers, stalling for the adapter's I2C bus lock.
Concurrently, an independent, parallel transfer on the same bus (e.g., a GPIO expander handling LEDs) can hold the I2C adapter lock. Inside this parallel transfer path, jz4780i2csetspeed() calls clkgetrate() on the host controller's input clock to calculate bus timings. This call attempts to acquire the blocked CCF 'preparelock', creating a circular dependency that freezes the system.
The jz4780 host controller clock itself is static and never changes at runtime.
However, calling clkgetrate() inside the active transfer path introduces an unnecessary dependency on the CCF internal locks.
Eliminate this synchronous clkgetrate() call from the active transfer path by caching the static host peripheral clock rate once - inside the private jz4780i2c structure during jz4780i2cprobe(). Update jz4780i2csetspeed() to use this cached value, safely decoupling active I2C transactions from the CCF internal locks without any risk of stale timings.
Assisted-by web based Google AI (pinpointing the bug and writing the message).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74463?
CVE-2026-74463 has been classified as a severe vulnerability due to the potential for deadlock situations.
How do I fix CVE-2026-74463?
To fix CVE-2026-74463, ensure you update your Linux kernel to the latest version where this vulnerability has been resolved.
What systems are affected by CVE-2026-74463?
CVE-2026-74463 affects systems using the Linux kernel with the I2C framework, especially those utilizing the jz4780 I2C adapter.
What are the potential impacts of CVE-2026-74463?
The potential impact of CVE-2026-74463 includes system hangs or crashes due to the deadlock between the Common Clock Framework and the I2C adapter.
Is there a workaround for CVE-2026-74463?
Currently, there are no documented workarounds for CVE-2026-74463; the recommended solution is to apply the kernel update.