« Volver al listado

CVE-2026-72142

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)

SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic (polling) path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has already started, so the target keeps holding SDA and the bus stays stuck until a power cycle for this i2c controller.

Reading I2DR to obtain the count likewise arms the next byte on the count > I2C_SMBUS_BLOCK_MAX path, which also returned -EPROTO directly and left the bus held.

Handle both: NACK the in-flight dummy byte (TXAK) and extend msgs->len so the existing last-byte handling emits STOP; the dummy byte is discarded.

Leer descripción completaMostrar menos

A count of 0 is a valid empty block read; a count above I2C_SMBUS_BLOCK_MAX is still reported as -EPROTO, but only after the bus has been released.

The interrupt-driven path has the same flaw from a later commit and is fixed separately, as it carries a different Fixes: tag and stable range.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72142",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
              "lessThan": "0f29df3c3d607a9dbc14aed0e45504ced4d2e7ec",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
              "lessThan": "38d4947431b2410850409fda016b2ac9f640a4dd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
              "lessThan": "e3e8b02d4773cfc5ad561d2e5505efde36c6927a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
              "lessThan": "016ef0f6ca4bc9bf0330ac41bd2ea349759643e3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
              "lessThan": "c882e8cc68fb993700dc21fd6e754001e6297934",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
              "lessThan": "6d2c973926d0612360693bc559be2ffde836151b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
              "lessThan": "60ed00d46616a9232e42ea7a3e3c0273d7cf7543",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
              "lessThan": "cb2fc37857693b55909fb77dc2c87cfbc1cdc476",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/i2c/busses/i2c-imx.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/i2c/busses/i2c-imx.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:21:31.827",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/016ef0f6ca4bc9bf0330ac41bd2ea349759643e3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/0f29df3c3d607a9dbc14aed0e45504ced4d2e7ec",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/38d4947431b2410850409fda016b2ac9f640a4dd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/60ed00d46616a9232e42ea7a3e3c0273d7cf7543",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6d2c973926d0612360693bc559be2ffde836151b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c882e8cc68fb993700dc21fd6e754001e6297934",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cb2fc37857693b55909fb77dc2c87cfbc1cdc476",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e3e8b02d4773cfc5ad561d2e5505efde36c6927a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: fix locked bus on SMBus block-read of 0 (atomic)\n\nSMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic\n(polling) path rejects it as -EPROTO. Worse, it returns without a\nNACK+STOP: the next receive cycle has already started, so the target\nkeeps holding SDA and the bus stays stuck until a power cycle for\nthis i2c controller.\n\nReading I2DR to obtain the count likewise arms the next byte on the\ncount > I2C_SMBUS_BLOCK_MAX path, which also returned -EPROTO directly\nand left the bus held.\n\nHandle both: NACK the in-flight dummy byte (TXAK) and extend msgs->len so\nthe existing last-byte handling emits STOP; the dummy byte is discarded.\nA count of 0 is a valid empty block read; a count above\nI2C_SMBUS_BLOCK_MAX is still reported as -EPROTO, but only after the bus\nhas been released.\n\nThe interrupt-driven path has the same flaw from a later commit and is\nfixed separately, as it carries a different Fixes: tag and stable range."
    }
  ],
  "lastModified": "2026-08-23T13:16:40.440",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}