CVE-2026-80678

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80678", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.783Z", "datePublished": "2026-08-28T06:52:47.077Z", "dateUpdated": "2026-10-16T19:26:32.757Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-29T06:22:05.188Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: Fix slave registration race and error handling\n\nIn i2c_imx_reg_slave(), the slave pointer was assigned before\npm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed,\nthe error path returned without clearing i2c_imx->slave, leaving it\nnon-NULL and causing all subsequent registration attempts to fail\nwith -EBUSY.\n\nAdditionally, because this driver uses a shared IRQ, the interrupt\nhandler i2c_imx_isr() can execute concurrently and, after acquiring\nslave_lock, dereference i2c_imx->slave. The previous fix attempt\nadded a lockless i2c_imx->slave = NULL on the error path, but that\ncould race with the ISR under the lock and still cause a NULL pointer\ndereference.\n\nFix both issues by deferring the assignment of i2c_imx->slave and\ni2c_imx->last_slave_event to after a successful resume, and by\nperforming the assignment inside the slave_lock critical section.\nThis guarantees that the slave pointer is never left stale on the\nerror path and is always valid when observed by the interrupt handler."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in i2c_imx_reg_slave() reached from kernel i2c_slave_register() during driver probe/module bind on embedded i.MX platforms; concurrent exploitation requires local I2C bus activity on the same adapter to fire the shared IRQ handler during registration.\nAC:L - The attacker controls the race by driving I2C slave traffic to trigger i2c_imx_isr() while registration runs, and can retry across reboots, OTA reprobes, or pm_runtime resume cycles until the unprotected slave-pointer window is hit.\nPR:N - No Linux credentials are needed when a physically proximate attacker races automated boot-time or service-driven i2c_slave_register() calls (DT probe, IPMI SSIF/MCTP backends) on imx I2C slave-capable controllers.\nUI:N - Exploitation requires no victim interaction; automated driver probe, suspend/resume, or maintenance-triggered slave registration provides the registration side of the race without user action.\nS:U - Impact is confined to kernel memory safety violations and crash on the same host; this is not a VM escape, IOMMU bypass, or other cross-security-authority boundary.\nC:H - The ISR can dereference a NULL or stale i2c_imx->slave under slave_lock when the error path races registration, violating memory safety and enabling arbitrary kernel read primitives per CVSS race/UAF guidance.\nI:H - Concurrent ISR handling during partial slave registration can corrupt driver state and invoke slave callbacks with inconsistent pointers, enabling heap manipulation and arbitrary kernel write or control-flow hijack beyond a simple crash.\nA:H - NULL or stale slave dereference in i2c_imx_isr()/i2c_imx_slave_event() causes kernel oops/panic; leaving slave non-NULL after failed pm_runtime_resume_and_get() also blocks all subsequent slave registration (-EBUSY) on affected controllers."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i2c/busses/i2c-imx.c"], "versions": [{"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "754bc62f72fd64b202462367134ac8ce95b005de", "status": "affected", "versionType": "git"}, {"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "cfdf6e13518589f911b7eace6ccb788e4ed87397", "status": "affected", "versionType": "git"}, {"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8", "status": "affected", "versionType": "git"}, {"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f", "status": "affected", "versionType": "git"}, {"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "12a4f0950a158d98552cbaeacc35edccd8d975fa", "status": "affected", "versionType": "git"}, {"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "614ca6594e301ff682999797c2216e9685558a2b", "status": "affected", "versionType": "git"}, {"version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "d64ec362c369bbc33833f7936d5f3a706b0d5c45", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/i2c/busses/i2c-imx.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/754bc62f72fd64b202462367134ac8ce95b005de"}, {"url": "https://git.kernel.org/stable/c/cfdf6e13518589f911b7eace6ccb788e4ed87397"}, {"url": "https://git.kernel.org/stable/c/b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8"}, {"url": "https://git.kernel.org/stable/c/d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f"}, {"url": "https://git.kernel.org/stable/c/12a4f0950a158d98552cbaeacc35edccd8d975fa"}, {"url": "https://git.kernel.org/stable/c/614ca6594e301ff682999797c2216e9685558a2b"}, {"url": "https://git.kernel.org/stable/c/d64ec362c369bbc33833f7936d5f3a706b0d5c45"}], "title": "i2c: imx: Fix slave registration race and error handling", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80678", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:19:46.218826Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:32.757Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80678", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:19:46.218826Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:19:47.427Z"}}], "cna": {"title": "i2c: imx: Fix slave registration race and error handling", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in i2c_imx_reg_slave() reached from kernel i2c_slave_register() during driver probe/module bind on embedded i.MX platforms; concurrent exploitation requires local I2C bus activity on the same adapter to fire the shared IRQ handler during registration.\nAC:L - The attacker controls the race by driving I2C slave traffic to trigger i2c_imx_isr() while registration runs, and can retry across reboots, OTA reprobes, or pm_runtime resume cycles until the unprotected slave-pointer window is hit.\nPR:N - No Linux credentials are needed when a physically proximate attacker races automated boot-time or service-driven i2c_slave_register() calls (DT probe, IPMI SSIF/MCTP backends) on imx I2C slave-capable controllers.\nUI:N - Exploitation requires no victim interaction; automated driver probe, suspend/resume, or maintenance-triggered slave registration provides the registration side of the race without user action.\nS:U - Impact is confined to kernel memory safety violations and crash on the same host; this is not a VM escape, IOMMU bypass, or other cross-security-authority boundary.\nC:H - The ISR can dereference a NULL or stale i2c_imx->slave under slave_lock when the error path races registration, violating memory safety and enabling arbitrary kernel read primitives per CVSS race/UAF guidance.\nI:H - Concurrent ISR handling during partial slave registration can corrupt driver state and invoke slave callbacks with inconsistent pointers, enabling heap manipulation and arbitrary kernel write or control-flow hijack beyond a simple crash.\nA:H - NULL or stale slave dereference in i2c_imx_isr()/i2c_imx_slave_event() causes kernel oops/panic; leaving slave non-NULL after failed pm_runtime_resume_and_get() also blocks all subsequent slave registration (-EBUSY) on affected controllers."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "754bc62f72fd64b202462367134ac8ce95b005de", "versionType": "git"}, {"status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "cfdf6e13518589f911b7eace6ccb788e4ed87397", "versionType": "git"}, {"status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8", "versionType": "git"}, {"status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f", "versionType": "git"}, {"status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "12a4f0950a158d98552cbaeacc35edccd8d975fa", "versionType": "git"}, {"status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "614ca6594e301ff682999797c2216e9685558a2b", "versionType": "git"}, {"status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "lessThan": "d64ec362c369bbc33833f7936d5f3a706b0d5c45", "versionType": "git"}], "programFiles": ["drivers/i2c/busses/i2c-imx.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"status": "unaffected", "version": "0", "lessThan": "5.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.217", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.151", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.103", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/i2c/busses/i2c-imx.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/754bc62f72fd64b202462367134ac8ce95b005de"}, {"url": "https://git.kernel.org/stable/c/cfdf6e13518589f911b7eace6ccb788e4ed87397"}, {"url": "https://git.kernel.org/stable/c/b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8"}, {"url": "https://git.kernel.org/stable/c/d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f"}, {"url": "https://git.kernel.org/stable/c/12a4f0950a158d98552cbaeacc35edccd8d975fa"}, {"url": "https://git.kernel.org/stable/c/614ca6594e301ff682999797c2216e9685558a2b"}, {"url": "https://git.kernel.org/stable/c/d64ec362c369bbc33833f7936d5f3a706b0d5c45"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: Fix slave registration race and error handling\n\nIn i2c_imx_reg_slave(), the slave pointer was assigned before\npm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed,\nthe error path returned without clearing i2c_imx->slave, leaving it\nnon-NULL and causing all subsequent registration attempts to fail\nwith -EBUSY.\n\nAdditionally, because this driver uses a shared IRQ, the interrupt\nhandler i2c_imx_isr() can execute concurrently and, after acquiring\nslave_lock, dereference i2c_imx->slave. The previous fix attempt\nadded a lockless i2c_imx->slave = NULL on the error path, but that\ncould race with the ISR under the lock and still cause a NULL pointer\ndereference.\n\nFix both issues by deferring the assignment of i2c_imx->slave and\ni2c_imx->last_slave_event to after a successful resume, and by\nperforming the assignment inside the slave_lock critical section.\nThis guarantees that the slave pointer is never left stale on the\nerror path and is always valid when observed by the interrupt handler."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.217", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.151", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.103", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.44", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.8", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-29T06:22:05.188Z"}}}, "cveMetadata": {"cveId": "CVE-2026-80678", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:26:32.757Z", "dateReserved": "2026-08-26T14:34:25.783Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-28T06:52:47.077Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/i2c/busses/i2c-imx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "754bc62f72fd64b202462367134ac8ce95b005de", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}, {"lessThan": "cfdf6e13518589f911b7eace6ccb788e4ed87397", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}, {"lessThan": "b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}, {"lessThan": "d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}, {"lessThan": "12a4f0950a158d98552cbaeacc35edccd8d975fa", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}, {"lessThan": "614ca6594e301ff682999797c2216e9685558a2b", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}, {"lessThan": "d64ec362c369bbc33833f7936d5f3a706b0d5c45", "status": "affected", "version": "f7414cd6923fd7f78e57086fc964ba2dc25db5c1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/i2c/busses/i2c-imx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: Fix slave registration race and error handling\n\nIn i2c_imx_reg_slave(), the slave pointer was assigned before\npm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed,\nthe error path returned without clearing i2c_imx->slave, leaving it\nnon-NULL and causing all subsequent registration attempts to fail\nwith -EBUSY.\n\nAdditionally, because this driver uses a shared IRQ, the interrupt\nhandler i2c_imx_isr() can execute concurrently and, after acquiring\nslave_lock, dereference i2c_imx->slave. The previous fix attempt\nadded a lockless i2c_imx->slave = NULL on the error path, but that\ncould race with the ISR under the lock and still cause a NULL pointer\ndereference.\n\nFix both issues by deferring the assignment of i2c_imx->slave and\ni2c_imx->last_slave_event to after a successful resume, and by\nperforming the assignment inside the slave_lock critical section.\nThis guarantees that the slave pointer is never left stale on the\nerror path and is always valid when observed by the interrupt handler."}], "id": "CVE-2026-80678", "lastModified": "2026-10-16T20:18:05.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-80678", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:19:46.218826Z", "version": "2.0.3"}}]}, "published": "2026-08-28T08:16:53.107", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/12a4f0950a158d98552cbaeacc35edccd8d975fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/614ca6594e301ff682999797c2216e9685558a2b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/754bc62f72fd64b202462367134ac8ce95b005de"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cfdf6e13518589f911b7eace6ccb788e4ed87397"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d64ec362c369bbc33833f7936d5f3a706b0d5c45"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: i2c: imx: Fix slave registration race and error handling", "id": "2525505", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525505"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ni2c: imx: Fix slave registration race and error handling\nIn i2c_imx_reg_slave(), the slave pointer was assigned before\npm_runtime_resume_and_get(). If pm_runtime_resume_and_get() failed,\nthe error path returned without clearing i2c_imx->slave, leaving it\nnon-NULL and causing all subsequent registration attempts to fail\nwith -EBUSY.\nAdditionally, because this driver uses a shared IRQ, the interrupt\nhandler i2c_imx_isr() can execute concurrently and, after acquiring\nslave_lock, dereference i2c_imx->slave. The previous fix attempt\nadded a lockless i2c_imx->slave = NULL on the error path, but that\ncould race with the ISR under the lock and still cause a NULL pointer\ndereference.\nFix both issues by deferring the assignment of i2c_imx->slave and\ni2c_imx->last_slave_event to after a successful resume, and by\nperforming the assignment inside the slave_lock critical section.\nThis guarantees that the slave pointer is never left stale on the\nerror path and is always valid when observed by the interrupt handler.", "A flaw was found in the Linux kernel's i2c: imx driver. A race condition during I2C slave registration and error handling could lead to a NULL pointer dereference. This occurs when the i2c_imx->slave pointer is not properly cleared or assigned, especially if power management operations fail or if the interrupt handler executes concurrently. A local attacker could potentially exploit this to cause a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-80678", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80678\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80678\nhttps://lore.kernel.org/linux-cve-announce/2026082800-CVE-2026-80678-ddd4@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f7414cd6923fd7f78e57086fc964ba2dc25db5c1,754bc62f72fd64b202462367134ac8ce95b005de)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f7414cd6923fd7f78e57086fc964ba2dc25db5c1,cfdf6e13518589f911b7eace6ccb788e4ed87397)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f7414cd6923fd7f78e57086fc964ba2dc25db5c1,b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f7414cd6923fd7f78e57086fc964ba2dc25db5c1,d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f7414cd6923fd7f78e57086fc964ba2dc25db5c1,12a4f0950a158d98552cbaeacc35edccd8d975fa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f7414cd6923fd7f78e57086fc964ba2dc25db5c1,614ca6594e301ff682999797c2216e9685558a2b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f7414cd6923fd7f78e57086fc964ba2dc25db5c1,d64ec362c369bbc33833f7936d5f3a706b0d5c45)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.217,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.151,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T10:45:04.387338+00:00", "updated": "2026-08-29T08:45:03.833801+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362", "CWE-476"]}