CVE-2026-74462
Description
A flaw was found in the Linux kernel's i.MX I2C driver. During system suspend and resume, a time window exists where I2C controller resources may be disabled or not yet restored. If a workqueue triggers an I2C transfer during this period, the driver attempts to access unavailable hardware resources, which can lead to a system hang. This vulnerability results in a Denial of Service (DoS).
Statement
A low impact flaw was found in the Linux kernel's i.MX I2C driver. During system suspend and resume there is a time window, between suspend_noirq and the system entering suspend and between the system starting to resume and resume_noirq, in which I2C controller resources such as clocks and pinctrl may already be disabled or not yet restored. On some i.MX platforms, certain I2C client drivers keep a periodic workqueue that continues to trigger I2C transfers; if such a transfer is issued in this window, the driver attempts to access I2C registers while the hardware resources are unavailable, which may lead to a system hang, resulting in a denial of service. The flaw is local-only, requires precise timing within a narrow suspend/resume window to trigger, and affects only availability, which is why Red Hat rated the impact as low even though the Red Hat CVSS 3.1 base score is 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, moderate).
The vulnerable code is present in Red Hat Enterprise Linux 10.2 and 10.3 (kernel), and in Red Hat In-Vehicle OS 2.0 and 2.1 (kernel and kernel-ivos-qualcomm components). For these affected streams the fix is currently deferred and will be delivered in a future planned update; the residual risk is a possible system hang during suspend/resume cycles on affected i.MX-based systems. Other Red Hat Enterprise Linux versions and streams (including RHEL 6, 7, 8, 9, and RHEL 10.0) do not contain the vulnerable code and are therefore not affected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
