CVE-2026-64236
Received Received - Intake

Division by Zero in Linux Kernel I2C Davinci Driver

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by zero on missing clock-frequency When the 'clock-frequency' property is missing from the device tree, the driver falls back to DAVINCI_I2C_DEFAULT_BUS_FREQ. However, this macro was defined in kHz (100), whereas the device tree property is expected in Hz. The probe function divided the fallback value by 1000, causing integer truncation that resulted in dev->bus_freq = 0. This triggered a deterministic division-by-zero kernel panic when calculating clock dividers later in the probe sequence. Fix this by redefining DAVINCI_I2C_DEFAULT_BUS_FREQ in Hz (100000) to match the expected device tree property unit, allowing the existing division logic to work correctly for both cases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64236
EUVD
EUVD-2026-48645

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a missing 'clock-frequency' property in the device tree causes a division by zero kernel panic. The driver incorrectly converted a fallback frequency value from kHz to Hz, resulting in a zero value that later triggered a crash during clock divider calculations.

Detection Guidance

This vulnerability is specific to the Linux kernel's i2c davinci driver and causes a kernel panic due to division by zero. Detection requires checking the kernel version and driver configuration. Use 'uname -a' to check kernel version and 'dmesg | grep i2c' to look for related errors.

Impact Analysis

If you use affected Linux kernel versions with Davinci I2C devices missing the 'clock-frequency' property, the system may crash with a kernel panic during boot or device initialization. This could lead to denial of service or system instability.

Compliance Impact

This vulnerability causes a kernel panic due to division by zero, which could lead to system crashes or instability. While it does not directly impact data privacy or security controls, such crashes may disrupt systems handling sensitive data, potentially affecting compliance with standards like GDPR or HIPAA that require availability and integrity of processing systems.

Mitigation Strategies

Apply the kernel patch that redefines DAVINCI_I2C_DEFAULT_BUS_FREQ in Hz. Update to a fixed kernel version if available. If using a custom kernel, ensure the patch is applied and rebuild.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64236. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart