CVE-2026-80678

Status: UPDATED  |  Advisory ID: CVE-2026-80678

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: Fix slave registration race and error handling

In i2c_imx_reg_slave(), the slave pointer was assigned before

pm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed,

the error path returned without clearing i2c_imx->slave, leaving it

non-NULL and causing all subsequent registration attempts to fail

with -EBUSY.

Additionally, because this driver uses a shared IRQ, the interrupt

handler i2c_imx_isr() can execute concurrently and, after acquiring

slave_lock, dereference i2c_imx->slave. The previous fix attempt

added a lockless i2c_imx->slave = NULL on the error path, but that

could race with the ISR under the lock and still cause a NULL pointer

dereference.

Fix both issues by deferring the assignment of i2c_imx->slave and

i2c_imx->last_slave_event to after a successful resume, and by

performing the assignment inside the slave_lock critical section.

This guarantees that the slave pointer is never left stale on the

error path and is always valid when observed by the interrupt handler. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References