CVE-2026-80678

Received Received - Intake

Race Condition in Linux Kernel i2c-imx Driver

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2c_imx_reg_slave(), the slave pointer was assigned before pm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed, the error path returned without clearing i2c_imx->slave, leaving it non-NULL and causing all subsequent registration attempts to fail with -EBUSY. Additionally, because this driver uses a shared IRQ, the interrupt handler i2c_imx_isr() can execute concurrently and, after acquiring slave_lock, dereference i2c_imx->slave. The previous fix attempt added a lockless i2c_imx->slave = NULL on the error path, but that could race with the ISR under the lock and still cause a NULL pointer dereference. Fix both issues by deferring the assignment of i2c_imx->slave and i2c_imx->last_slave_event to after a successful resume, and by performing the assignment inside the slave_lock critical section. This guarantees that the slave pointer is never left stale on the error path and is always valid when observed by the interrupt handler.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80678

EUVD

EUVD-2026-67554

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the i2c_imx driver's slave registration process. The issue occurs when the slave pointer is assigned before ensuring the device is properly resumed. If the resume operation fails, the error path leaves the slave pointer non-NULL, causing future registration attempts to fail with -EBUSY. Additionally, a concurrent interrupt handler could dereference this stale pointer, leading to potential NULL pointer dereferences.

Detection Guidance

This vulnerability is specific to the Linux kernel's i2c imx driver and does not have network-based detection methods. Detection involves checking kernel logs for errors related to i2c_imx driver failures or slave registration issues. Commands like dmesg | grep -i i2c or journalctl -k | grep -i i2c_imx may reveal errors.

Impact Analysis

This vulnerability could cause system instability or denial of service if the i2c_imx driver fails to register I2C slave devices properly. It may prevent critical hardware components from functioning, leading to system crashes or unresponsive peripherals. Systems relying on I2C communication could experience disruptions in functionality.

Compliance Impact

This vulnerability is a Linux kernel driver issue affecting I2C communication and does not directly impact compliance with standards like GDPR or HIPAA. It involves a race condition in slave registration that could cause system instability or denial of service, but there is no evidence it leads to data breaches or unauthorized access relevant to these regulations.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to ensure the fix is included. If immediate patching is not possible, avoid using the i2c imx driver in slave mode until patched. Monitor kernel logs for related errors as a sign of exploitation or misconfiguration.

Hi! I’m here to help you understand CVE-2026-80678. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70