Vulnerability-Lookup

FKIE_CVE-2026-80678

Vulnerability from fkie_nvd - Published: 2026-08-28 08:16 - Updated: 2026-08-29 07:16

Severity

8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2c_imx_reg_slave(), the slave pointer was assigned before pm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed, the error path returned without clearing i2c_imx->slave, leaving it non-NULL and causing all subsequent registration attempts to fail with -EBUSY. Additionally, because this driver uses a shared IRQ, the interrupt handler i2c_imx_isr() can execute concurrently and, after acquiring slave_lock, dereference i2c_imx->slave. The previous fix attempt added a lockless i2c_imx->slave = NULL on the error path, but that could race with the ISR under the lock and still cause a NULL pointer dereference. Fix both issues by deferring the assignment of i2c_imx->slave and i2c_imx->last_slave_event to after a successful resume, and by performing the assignment inside the slave_lock critical section. This guarantees that the slave pointer is never left stale on the error path and is always valid when observed by the interrupt handler.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/12a4f0950a158d98552cbaeacc35edccd8d975fa
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/614ca6594e301ff682999797c2216e9685558a2b
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/754bc62f72fd64b202462367134ac8ce95b005de
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/cfdf6e13518589f911b7eace6ccb788e4ed87397
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d64ec362c369bbc33833f7936d5f3a706b0d5c45
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-imx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "754bc62f72fd64b202462367134ac8ce95b005de",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            },
            {
              "lessThan": "cfdf6e13518589f911b7eace6ccb788e4ed87397",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            },
            {
              "lessThan": "b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            },
            {
              "lessThan": "d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            },
            {
              "lessThan": "12a4f0950a158d98552cbaeacc35edccd8d975fa",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            },
            {
              "lessThan": "614ca6594e301ff682999797c2216e9685558a2b",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            },
            {
              "lessThan": "d64ec362c369bbc33833f7936d5f3a706b0d5c45",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-imx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: Fix slave registration race and error handling\n\nIn i2c_imx_reg_slave(), the slave pointer was assigned before\npm_runtime_resume_and_get().  If pm_runtime_resume_and_get() failed,\nthe error path returned without clearing i2c_imx-\u003eslave, leaving it\nnon-NULL and causing all subsequent registration attempts to fail\nwith -EBUSY.\n\nAdditionally, because this driver uses a shared IRQ, the interrupt\nhandler i2c_imx_isr() can execute concurrently and, after acquiring\nslave_lock, dereference i2c_imx-\u003eslave.  The previous fix attempt\nadded a lockless i2c_imx-\u003eslave = NULL on the error path, but that\ncould race with the ISR under the lock and still cause a NULL pointer\ndereference.\n\nFix both issues by deferring the assignment of i2c_imx-\u003eslave and\ni2c_imx-\u003elast_slave_event to after a successful resume, and by\nperforming the assignment inside the slave_lock critical section.\nThis guarantees that the slave pointer is never left stale on the\nerror path and is always valid when observed by the interrupt handler."
    }
  ],
  "id": "CVE-2026-80678",
  "lastModified": "2026-08-29T07:16:50.230",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-28T08:16:53.107",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/12a4f0950a158d98552cbaeacc35edccd8d975fa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/614ca6594e301ff682999797c2216e9685558a2b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/754bc62f72fd64b202462367134ac8ce95b005de"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cfdf6e13518589f911b7eace6ccb788e4ed87397"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d64ec362c369bbc33833f7936d5f3a706b0d5c45"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-80678 (GCVE-0-2026-80678)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:52 – Updated: 2026-08-29 06:22

Title

i2c: imx: Fix slave registration race and error handling

Summary

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/754bc62f72fd64b20…
https://git.kernel.org/stable/c/cfdf6e13518589f91…
https://git.kernel.org/stable/c/b9f6f4883b9ac8665…
https://git.kernel.org/stable/c/d6748f6802f3eebaf…
https://git.kernel.org/stable/c/12a4f0950a158d985…
https://git.kernel.org/stable/c/614ca6594e301ff68…
https://git.kernel.org/stable/c/d64ec362c369bbc33…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < 754bc62f72fd64b202462367134ac8ce95b005de (git) Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < cfdf6e13518589f911b7eace6ccb788e4ed87397 (git) Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8 (git) Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f (git) Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < 12a4f0950a158d98552cbaeacc35edccd8d975fa (git) Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < 614ca6594e301ff682999797c2216e9685558a2b (git) Affected: f7414cd6923fd7f78e57086fc964ba2dc25db5c1 , < d64ec362c369bbc33833f7936d5f3a706b0d5c45 (git)
Linux	Linux	Affected: 5.11 Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-imx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "754bc62f72fd64b202462367134ac8ce95b005de",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            },
            {
              "lessThan": "cfdf6e13518589f911b7eace6ccb788e4ed87397",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            },
            {
              "lessThan": "b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            },
            {
              "lessThan": "d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            },
            {
              "lessThan": "12a4f0950a158d98552cbaeacc35edccd8d975fa",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            },
            {
              "lessThan": "614ca6594e301ff682999797c2216e9685558a2b",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            },
            {
              "lessThan": "d64ec362c369bbc33833f7936d5f3a706b0d5c45",
              "status": "affected",
              "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-imx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: Fix slave registration race and error handling\n\nIn i2c_imx_reg_slave(), the slave pointer was assigned before\npm_runtime_resume_and_get().  If pm_runtime_resume_and_get() failed,\nthe error path returned without clearing i2c_imx-\u003eslave, leaving it\nnon-NULL and causing all subsequent registration attempts to fail\nwith -EBUSY.\n\nAdditionally, because this driver uses a shared IRQ, the interrupt\nhandler i2c_imx_isr() can execute concurrently and, after acquiring\nslave_lock, dereference i2c_imx-\u003eslave.  The previous fix attempt\nadded a lockless i2c_imx-\u003eslave = NULL on the error path, but that\ncould race with the ISR under the lock and still cause a NULL pointer\ndereference.\n\nFix both issues by deferring the assignment of i2c_imx-\u003eslave and\ni2c_imx-\u003elast_slave_event to after a successful resume, and by\nperforming the assignment inside the slave_lock critical section.\nThis guarantees that the slave pointer is never left stale on the\nerror path and is always valid when observed by the interrupt handler."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in i2c_imx_reg_slave() reached from kernel i2c_slave_register() during driver probe/module bind on embedded i.MX platforms; concurrent exploitation requires local I2C bus activity on the same adapter to fire the shared IRQ handler during registration.\nAC:L - The attacker controls the race by driving I2C slave traffic to trigger i2c_imx_isr() while registration runs, and can retry across reboots, OTA reprobes, or pm_runtime resume cycles until the unprotected slave-pointer window is hit.\nPR:N - No Linux credentials are needed when a physically proximate attacker races automated boot-time or service-driven i2c_slave_register() calls (DT probe, IPMI SSIF/MCTP backends) on imx I2C slave-capable controllers.\nUI:N - Exploitation requires no victim interaction; automated driver probe, suspend/resume, or maintenance-triggered slave registration provides the registration side of the race without user action.\nS:U - Impact is confined to kernel memory safety violations and crash on the same host; this is not a VM escape, IOMMU bypass, or other cross-security-authority boundary.\nC:H - The ISR can dereference a NULL or stale i2c_imx-\u003eslave under slave_lock when the error path races registration, violating memory safety and enabling arbitrary kernel read primitives per CVSS race/UAF guidance.\nI:H - Concurrent ISR handling during partial slave registration can corrupt driver state and invoke slave callbacks with inconsistent pointers, enabling heap manipulation and arbitrary kernel write or control-flow hijack beyond a simple crash.\nA:H - NULL or stale slave dereference in i2c_imx_isr()/i2c_imx_slave_event() causes kernel oops/panic; leaving slave non-NULL after failed pm_runtime_resume_and_get() also blocks all subsequent slave registration (-EBUSY) on affected controllers."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:05.188Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/754bc62f72fd64b202462367134ac8ce95b005de"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfdf6e13518589f911b7eace6ccb788e4ed87397"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f"
        },
        {
          "url": "https://git.kernel.org/stable/c/12a4f0950a158d98552cbaeacc35edccd8d975fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/614ca6594e301ff682999797c2216e9685558a2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d64ec362c369bbc33833f7936d5f3a706b0d5c45"
        }
      ],
      "title": "i2c: imx: Fix slave registration race and error handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80678",
    "datePublished": "2026-08-28T06:52:47.077Z",
    "dateReserved": "2026-08-26T14:34:25.783Z",
    "dateUpdated": "2026-08-29T06:22:05.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.