CVE-2026-80678

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: Fix slave registration race and error handling

In i2c_imx_reg_slave(), the slave pointer was assigned before

pm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed,

the error path returned without clearing i2c_imx->slave, leaving it

non-NULL and causing all subsequent registration attempts to fail

with -EBUSY.

Additionally, because this driver uses a shared IRQ, the interrupt

handler i2c_imx_isr() can execute concurrently and, after acquiring

slave_lock, dereference i2c_imx->slave. The previous fix attempt

added a lockless i2c_imx->slave = NULL on the error path, but that

could race with the ISR under the lock and still cause a NULL pointer

dereference.

Fix both issues by deferring the assignment of i2c_imx->slave and

i2c_imx->last_slave_event to after a successful resume, and by

performing the assignment inside the slave_lock critical section.

This guarantees that the slave pointer is never

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References