CVE-2026-64236

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64236", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.771Z", "datePublished": "2026-07-24T15:27:41.371Z", "dateUpdated": "2026-07-24T15:27:41.371Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-24T15:27:41.371Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: davinci: fix division by zero on missing clock-frequency\n\nWhen the 'clock-frequency' property is missing from the device tree,\nthe driver falls back to DAVINCI_I2C_DEFAULT_BUS_FREQ. However, this\nmacro was defined in kHz (100), whereas the device tree property is\nexpected in Hz.\n\nThe probe function divided the fallback value by 1000, causing\ninteger truncation that resulted in dev->bus_freq = 0. This triggered\na deterministic division-by-zero kernel panic when calculating clock\ndividers later in the probe sequence.\n\nFix this by redefining DAVINCI_I2C_DEFAULT_BUS_FREQ in Hz (100000)\nto match the expected device tree property unit, allowing the existing\ndivision logic to work correctly for both cases."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i2c/busses/i2c-davinci.c"], "versions": [{"version": "b04ce63859793e3439b394976b8d29e785d4d69a", "lessThan": "3f43865cb64dd7cb50efae1281a95585617b12a1", "status": "affected", "versionType": "git"}, {"version": "b04ce63859793e3439b394976b8d29e785d4d69a", "lessThan": "9b694bc0e1831cbc5c3bbfd1b156ec719128f7d9", "status": "affected", "versionType": "git"}, {"version": "b04ce63859793e3439b394976b8d29e785d4d69a", "lessThan": "030675aa54cf757769b3db65642433d626b3ed7c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i2c/busses/i2c-davinci.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3f43865cb64dd7cb50efae1281a95585617b12a1"}, {"url": "https://git.kernel.org/stable/c/9b694bc0e1831cbc5c3bbfd1b156ec719128f7d9"}, {"url": "https://git.kernel.org/stable/c/030675aa54cf757769b3db65642433d626b3ed7c"}], "title": "i2c: davinci: fix division by zero on missing clock-frequency", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/i2c/busses/i2c-davinci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3f43865cb64dd7cb50efae1281a95585617b12a1", "status": "affected", "version": "b04ce63859793e3439b394976b8d29e785d4d69a", "versionType": "git"}, {"lessThan": "9b694bc0e1831cbc5c3bbfd1b156ec719128f7d9", "status": "affected", "version": "b04ce63859793e3439b394976b8d29e785d4d69a", "versionType": "git"}, {"lessThan": "030675aa54cf757769b3db65642433d626b3ed7c", "status": "affected", "version": "b04ce63859793e3439b394976b8d29e785d4d69a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/i2c/busses/i2c-davinci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C404AD58-4839-4D26-8300-E80C867013EF", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: davinci: fix division by zero on missing clock-frequency\n\nWhen the 'clock-frequency' property is missing from the device tree,\nthe driver falls back to DAVINCI_I2C_DEFAULT_BUS_FREQ. However, this\nmacro was defined in kHz (100), whereas the device tree property is\nexpected in Hz.\n\nThe probe function divided the fallback value by 1000, causing\ninteger truncation that resulted in dev->bus_freq = 0. This triggered\na deterministic division-by-zero kernel panic when calculating clock\ndividers later in the probe sequence.\n\nFix this by redefining DAVINCI_I2C_DEFAULT_BUS_FREQ in Hz (100000)\nto match the expected device tree property unit, allowing the existing\ndivision logic to work correctly for both cases."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ni2c: davinci: corregir divisi\u00f3n por cero por falta de \u2019clock-frequency\u2019\n\nCuando la propiedad \u2019clock-frequency\u2019 falta del \u00e1rbol de dispositivos, el controlador recurre a DAVINCI_I2C_DEFAULT_BUS_FREQ. Sin embargo, esta macro fue definida en kHz (100), mientras que la propiedad del \u00e1rbol de dispositivos se espera en Hz.\n\nLa funci\u00f3n de sondeo dividi\u00f3 el valor de respaldo por 1000, causando un truncamiento de enteros que result\u00f3 en dev -> bus_freq = 0. Esto desencaden\u00f3 un p\u00e1nico de kernel determinista por divisi\u00f3n por cero al calcular los divisores de reloj m\u00e1s tarde en la secuencia de sondeo.\n\nCorregir esto redefiniendo DAVINCI_I2C_DEFAULT_BUS_FREQ en Hz (100000) para que coincida con la unidad de propiedad esperada del \u00e1rbol de dispositivos, permitiendo que la l\u00f3gica de divisi\u00f3n existente funcione correctamente para ambos casos."}], "id": "CVE-2026-64236", "lastModified": "2026-10-27T18:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-24T16:16:52.860", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/030675aa54cf757769b3db65642433d626b3ed7c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3f43865cb64dd7cb50efae1281a95585617b12a1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9b694bc0e1831cbc5c3bbfd1b156ec719128f7d9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-369"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: i2c: davinci: fix division by zero on missing clock-frequency", "id": "2506818", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506818"}, "csaw": false, "cwe": "CWE-369", "details": ["A flaw was found in the i2c davinci driver of the Linux kernel. When the 'clock-frequency' property is missing from the device tree, the driver's fallback mechanism can lead to a division-by-zero error. This vulnerability can be triggered by a local attacker providing a malformed device tree, resulting in a kernel panic and a denial of service."], "name": "CVE-2026-64236", "public_date": "2026-07-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64236\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64236\nhttps://lore.kernel.org/linux-cve-announce/2026072440-CVE-2026-64236-b38d@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b04ce63859793e3439b394976b8d29e785d4d69a,3f43865cb64dd7cb50efae1281a95585617b12a1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b04ce63859793e3439b394976b8d29e785d4d69a,9b694bc0e1831cbc5c3bbfd1b156ec719128f7d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b04ce63859793e3439b394976b8d29e785d4d69a,030675aa54cf757769b3db65642433d626b3ed7c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.35,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.12,7.0.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T01:15:03.357995+00:00", "updated": "2026-08-13T11:15:05.121506+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}