CVE-2026-64278

Analyzed Analyzed - Analysis Complete

I2C Controller Suspend Handling in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: imx-lpi2c: mark I2C adapter when hardware is powered down On some i.MX platforms, certain I2C client drivers keep a periodic workqueue which continues to trigger I2C transfers. During system suspend/resume, there exists a time window between: - suspend_noirq and the system entering suspend - the system starting to resume and resume_noirq In this window, the I2C controller resources such as clock and pinctrl may already be disabled or not yet restored. If a workqueue triggers an I2C transfer in this period, the driver attempts to access I2C registers while the hardware resources are unavailable, which may lead to system hang. Mark the I2C adapter as suspended during noirq suspend and block new transfers until resume, ensuring that I2C transfers are only issued when hardware resources are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64278

EUVD

EUVD-2026-48990

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 6.14 (inc) to 6.18.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel's i2c: imx-lpi2c driver. It occurs when the I2C controller's hardware resources like clock and pinctrl are disabled during system suspend/resume but a workqueue still triggers I2C transfers. This causes the driver to access unavailable hardware, potentially leading to a system hang.

Detection Guidance

This vulnerability is specific to the Linux kernel's i2c: imx-lpi2c driver on i.MX platforms. Detection involves checking kernel logs for I2C transfer failures during suspend/resume cycles or system hangs. Monitor dmesg for errors like 'i2c-lpi2c: timeout waiting for bus not busy' or 'unable to complete message'. Check if your system uses affected i.MX platforms with vulnerable kernels.

Impact Analysis

If exploited, this vulnerability could cause your system to hang or become unresponsive during suspend/resume operations. This may lead to data loss, interrupted processes, or require a manual reboot to recover.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel I2C driver issue causing system hangs during suspend/resume. No data exposure or privacy impact is described.

Mitigation Strategies

Apply the kernel patch that marks the I2C adapter as suspended during noirq suspend. Update to a Linux kernel version that includes the fix. If using a custom kernel, backport the patch from the upstream Linux kernel. Disable periodic workqueues for I2C client drivers if they are not critical. Monitor system behavior during suspend/resume cycles after applying fixes.

Hi! I’m here to help you understand CVE-2026-64278. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70