CVE-2026-72141

Received Received - Intake

I2C Bus Locking in Linux Kernel SMBus

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has already started, so the target keeps holding SDA and the bus stays stuck until a power cycle of this i2c controller. Accept count=0: NACK the in-flight dummy byte (TXAK) and set msg->len to 2 so i2c_imx_isr_read_continue() emits STOP via its normal last-byte path. The dummy byte is discarded; block-read callers only consume buf[0..count-1]. Reading I2DR has likewise already armed the next byte on the count > I2C_SMBUS_BLOCK_MAX error path, so NACK it (TXAK) before aborting with -EPROTO; otherwise the failing transfer's STOP cannot complete and the bus stays held. The atomic path regressed earlier (v3.16) and is fixed separately; this patch covers only the v6.13 state-machine rework.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72141

EUVD

EUVD-2026-58899

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel's i2c imx driver. It involves a flaw in handling SMBus block-read operations where a byte count of 0 is incorrectly rejected, causing the I2C bus to lock up. The state machine fails to send a NACK and STOP signal, leaving the bus in a stuck state until a power cycle.

Detection Guidance

This vulnerability is specific to the Linux kernel's i2c imx driver and involves a bus lock condition during SMBus block-read operations. Detection requires checking the kernel version and driver behavior. No direct network detection commands are applicable. Inspect kernel logs for i2c errors or bus hangs after SMBus operations.

Impact Analysis

If exploited, this vulnerability could cause the I2C bus to become unresponsive, potentially disrupting communication between hardware components. Systems relying on I2C for critical functions may experience hangs or require a power cycle to recover.

Compliance Impact

This vulnerability affects compliance with standards and regulations by potentially causing data integrity issues due to a locked I2C bus. If the bus remains stuck, it could disrupt communication between hardware components, leading to incomplete or corrupted data transfers. This may impact systems handling sensitive data under GDPR or HIPAA, where data integrity and availability are critical.

Mitigation Strategies

Apply the kernel patch fixing the i2c imx driver's SMBus block-read handling. Update to a patched kernel version if available. Monitor i2c bus activity for hangs and restart the controller if necessary. Avoid SMBus block-read operations with zero byte counts until patched.

Hi! I’m here to help you understand CVE-2026-72141. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70