CVE-2026-23369

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"

This reverts commit f707d6b9e7c18f669adfdb443906d46cfbaaa0c1.

Under rare circumstances, multiple udev threads can collect i801 device

info on boot and walk i801_acpi_io_handler somewhat concurrently. The

first will note the area is reserved by acpi to prevent further touches.

This ultimately causes the area to be deregistered. The second will

enter i801_acpi_io_handler after the area is unregistered but before a

check can be made that the area is unregistered. i2c_lock_bus relies on

the now unregistered area containing lock_ops to lock the bus. The end

result is a kernel panic on boot with the following backtrace;

[ 14.971872] ioatdma 0000:09:00.2: enabling device (0100 -> 0102)

[ 14.971873] BUG: kernel NULL pointer dereference, address: 0000000000000000

[ 14.971880] #PF: supervisor read access in kernel mode

[ 14.971884] #PF: error_code(0x0

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References