i2c: imx: Fix slave registration race and error handling (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.14 % · centile 3 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2c_imx_reg_slave(), the slave pointer was assigned before pm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed, the error path returned without clearing i2c_imx->slave, leaving it non-NULL and causing all subsequent registration attempts to fail with -EBUSY. Additionally, because this driver uses a shared IRQ, the interrupt handler i2c_imx_isr() can execute concurrently and, after acquiring slave_lock, dereference i2c_imx->slave. The previous fix attempt added a lockless i2c_imx->slave = NULL on the error path, but that could race with the ISR under the lock and still cause a NULL pointer dereference. Fix both issues by deferring the assignment of i2c_imx->slave and i2c_imx->last_slave_event to after a successful resume, and by performing the assignment inside the slave_lock critical section. This guarantees that the slave pointer is never left stale on the error path and is always valid when observed by the interrupt handler.
Références
- https://git.kernel.org/stable/c/754bc62f72fd64b202462367134ac8ce95b005de
- https://git.kernel.org/stable/c/cfdf6e13518589f911b7eace6ccb788e4ed87397
- https://git.kernel.org/stable/c/b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8
- https://git.kernel.org/stable/c/d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f
- https://git.kernel.org/stable/c/12a4f0950a158d98552cbaeacc35edccd8d975fa
- https://git.kernel.org/stable/c/614ca6594e301ff682999797c2216e9685558a2b
- https://git.kernel.org/stable/c/d64ec362c369bbc33833f7936d5f3a706b0d5c45
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-67554
- GCVE · GCVE-0-2026-80678
Avis du CERT-FR
- CERTFR-2026-AVI-1232 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1163 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 < 754bc62f72fd64b202462367134ac8ce95b005de ; affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 < cfdf6e13518589f911b7eace6ccb788e4ed87397 ; affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 < b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8 ; affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 < d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f ; affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 < 12a4f0950a158d98552cbaeacc35edccd8d975fa ; affected f7414cd6923fd7f78e57086fc964ba2dc25db5c1 < 614ca6594e301ff682999797c2216e9685558a2b |
| Linux · Linux | affected 5.11 ; unaffected 0 < 5.11 ; unaffected 5.15.217 ≤ 5.15.* ; unaffected 6.1.183 ≤ 6.1.* ; unaffected 6.6.151 ≤ 6.6.* ; unaffected 6.12.103 ≤ 6.12.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |