CVE-2026-80678: i2c: imx: Fix slave registration race and error handling
i2c: imx: Fix slave registration race and error handling
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux Kernel i2c-imx driver and registering an I2C slave are affected by the faulty registration handling. The race is relevant because the driver uses a shared IRQ, allowing its interrupt handler to run concurrently with slave registration.
What conditions cause the registration failure or crash risk?
If pm_runtime_resume_and_get() fails after the driver records the slave pointer, that pointer can remain stale and later registration attempts can fail with -EBUSY. A concurrent interrupt handler can also observe an improperly updated slave pointer, creating a NULL pointer dereference risk.
How can an administrator recognize the registration-handling failure?
After a runtime-resume failure during slave registration, subsequent attempts to register a slave may consistently fail with -EBUSY. This behavior indicates that the driver may have retained a non-NULL slave pointer from the failed attempt.