CVE-2026-23055
Improper Suspend Handling in Linux i2c riic Driver Causes System Warnings
Publication date: 2026-02-04
Last updated on: 2026-02-04
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| renesas | i2c | *-* |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Renesas I2C driver in the Linux kernel where I2C transfers can be attempted while the controller is already suspended. This happens due to improper ordering of system sleep callbacks.
Specifically, after adding suspend support, the system may try to transfer data over I2C during suspend, triggering warnings and potential issues because the controller is not properly available during certain suspend phases.
The root cause is that if the controller is autosuspended, it cannot be woken up once runtime power management is disabled during the suspend process, making the controller unavailable too early.
The fix moves suspend handling to the NOIRQ phase, ensuring the I2C controller remains available until the appropriate suspend_noirq callback and is restored early enough during resume, preventing transfers while suspended.
How can this vulnerability impact me? :
This vulnerability can cause system warnings and instability during suspend and resume cycles on affected hardware using the Renesas I2C driver.
If I2C transfers are attempted while the controller is suspended, it may lead to failed communications with I2C devices, potentially causing malfunction or data loss in components relying on I2C.
In embedded or hardware-dependent systems, this could result in degraded system reliability or unexpected behavior during power management operations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing specific WARNING messages in the system logs related to I2C transfers during suspend. The key indicator is a warning message similar to:
- [ 134.290298] i2c i2c-2: Transfer while suspended
- [ 134.295174] WARNING: drivers/i2c/i2c-core.h:56 at __i2c_smbus_xfer+0x1e4/0x214, CPU#0: systemd-sleep/388
To detect this on your system, you can check the kernel log for such warnings using commands like:
- dmesg | grep 'i2c.*Transfer while suspended'
- journalctl -k | grep 'i2c.*Transfer while suspended'
- journalctl -k | grep WARNING | grep i2c
What immediate steps should I take to mitigate this vulnerability?
The vulnerability arises because I2C transfers are attempted while the controller is suspended due to improper ordering of system sleep callbacks.
To mitigate this issue immediately, ensure that the I2C controller is woken up during the suspend() callback while runtime power management (PM) is still enabled. This allows the controller to remain available until the suspend_noirq() callback.
During resume, the controller should be restored in the resume_noirq() callback, and autosuspend should be re-enabled in the resume() callback.
If you are managing kernel code or device drivers, apply the patch or commit that moves suspend handling to the NOIRQ phase, as described in commit 53326135d0e0.
If you are an end user, update your Linux kernel to a version that includes this fix to prevent the warning and potential issues.