HIGH Introduced in 5.11
i2c-imx SlaveReg Race
CVE-2026-80678
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.3HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and error handling In i2c_imx_reg_slave(), the slave pointer was assigned before pm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed, the error path returned without clearing i2c_imx->slave, leaving it non-NULL and causing all subsequent registration attempts to fail with -EBUSY. Additionally, because this driver uses a shared IRQ, the interrupt handler i2c_imx_isr() can execute concurrently and, after acquiring slave_lock, dereference i2c_imx->slave. The previous fix attempt added a lockless i2c_imx->slave = NULL on the error path, but that could race with the ISR under the lock and still cause a NULL pointer dereference. Fix both issues by deferring the assignment of i2c_imx->slave and i2c_imx->last_slave_event to after a successful resume, and by performing the assignment inside the slave_lock critical section. This guarantees that the slave pointer is never left stale on the error path and is always valid when observed by the interrupt handler.
02KernelScan AI Analysis
Risk summary
A race condition in the NXP i.MX I2C driver's slave registration path can cause the interrupt handler to dereference a stale or invalid pointer, leading to memory corruption and a kernel crash. The bug occurs when slave registration fails and the interrupt handler concurrently accesses the driver’s slave reference. Systems using the i2c-imx driver with I2C slave mode enabled are affected.
Vulnerability analysis
The driver for the NXP i.MX I2C controller sets up its internal slave reference before confirming that the device has fully powered on. If power management resume fails, that reference is left stale, so later registration attempts are permanently rejected. Worse, because the controller shares its interrupt line, the interrupt handler can run at the same time and follow that stale reference, corrupting memory or crashing the kernel. The correction waits to establish the slave reference until after resume succeeds, and only does so while holding the driver’s lock, so the interrupt handler always sees either a valid, fully initialized reference or none at all. The flaw can be reached on any system using this driver in I2C slave mode, by a local user who can trigger slave registration while the bus is active.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.11 | 5.15.217 | 754bc62f72fd |
| 6.6 | 5.11 | 6.6.151 | b9f6f4883b9a |
| 6.18 | 5.11 | 6.18.44 | 12a4f0950a15 |
| 7.1 | 5.11 | 7.1.8 | 614ca6594e30 |
| 6.1 | 5.11 | 6.1.183 | cfdf6e135185 |
| 6.12 | 5.11 | 6.12.103 | d6748f6802f3 |
| mainline | 5.11 | 7.2 | d64ec362c369 |
| cip/6.1 | 5.11 | 6.1.187-cip60 | cfdf6e135185 |
| cip/6.12 | 5.11 | 6.12.104-cip30 | d6748f6802f3 |