CVE-2026-80678
Description
A flaw was found in the Linux kernel's i2c: imx driver. A race condition during I2C slave registration and error handling could lead to a NULL pointer dereference. This occurs when the i2c_imx->slave pointer is not properly cleared or assigned, especially if power management operations fail or if the interrupt handler executes concurrently. A local attacker could potentially exploit this to cause a system crash, resulting in a Denial of Service (DoS).
Statement
The i2c imx slave registration path can leave the adapter slave pointer in an inconsistent state when pm_runtime_resume_and_get fails after the pointer was already assigned. A shared IRQ handler can run concurrently and observe this pointer while handling slave events, which can lead to a NULL pointer dereference or a stale pointer use depending on timing and client lifetime. For the CVSS the PR:L is used for the paranoid interpretation because delegated device management, container root, or a service account may be able to trigger slave registration or controller resume paths in some deployments, while typical systems are closer to PR:H. The issue is not network reachable and requires local interaction with the I2C controller or its driver control path. Impact is at least local denial of service via kernel crash, with limited confidentiality or integrity impact kept only for the paranoid score because the race touches pointer validity but does not show a clear arbitrary write primitive.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 8.4 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
