i2c: imx: Fix slave registration race and error handling (Linux Linux)

CVE-2026-80678
HIGH 8.4

At a glance

Source
NVD
EPSS
EPSS 0.14 % · percentile 3 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Received

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2c_imx_reg_slave(), the slave pointer was assigned before pm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed, the error path returned without clearing i2c_imx->slave, leaving it non-NULL and causing all subsequent registration attempts to fail with -EBUSY. Additionally, because this driver uses a shared IRQ, the interrupt handler i2c_imx_isr() can execute concurrently and, after acquiring slave_lock, dereference i2c_imx->slave. The previous fix attempt added a lockless i2c_imx->slave = NULL on the error path, but that could race with the ISR under the lock and still cause a NULL pointer dereference. Fix both issues by deferring the assignment of i2c_imx->slave and i2c_imx->last_slave_event to after a successful resume, and by performing the assignment inside the slave_lock critical section. This guarantees that the slave pointer is never left stale on the error path and is always valid when observed by the interrupt handler.

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 8.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 8.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
Linux · Linuxaffected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 < 754bc62f72fd64b202462367134ac8ce95b005de ; affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 < cfdf6e13518589f911b7eace6ccb788e4ed87397 ; affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 < b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8 ; affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 < d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f ; affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 < 12a4f0950a158d98552cbaeacc35edccd8d975fa ; affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 < 614ca6594e301ff682999797c2216e9685558a2b
Linux · Linuxaffected 5.11 ; unaffected 0 < 5.11 ; unaffected 5.15.217 ≤ 5.15.* ; unaffected 6.1.183 ≤ 6.1.* ; unaffected 6.6.151 ≤ 6.6.* ; unaffected 6.12.103 ≤ 6.12.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD