Executive brief
The i2c-imx driver in the Linux kernel has a flaw in its SMBus block-read handling that can permanently lock an I2C bus. When a block read with 0 bytes is attempted, the driver fails to properly release the bus, causing it to hang until the I2C controller is power-cycled. This affects embedded systems and devices that rely on I2C communication for sensor, memory, or peripheral control.
Technical details
The vulnerability is a state machine error in the interrupt-driven SMBus block-read handler (i2c_imx_isr_read_block_data_len function) in drivers/i2c/busses/i2c-imx.c. When a block read count of 0 is received, the driver incorrectly rejects it with -EPROTO and returns without sending a NACK and STOP condition. Since the receive cycle has already started, the target device continues holding the SDA line and the bus becomes deadlocked. The fix adds proper NACK handling (TXAK) for both count=0 and count>I2C_SMBUS_BLOCK_MAX cases to ensure the bus is released. The vulnerability affects Linux kernel v6.13 and later due to a state-machine rework introduced in commit 5f5c2d4579ca; an earlier regression in v3.16 is addressed separately.
Affected products
- Linux Linux kernel v6.13+
Timeline
- 2026-08-15: disclosed: CVE-2026-72141 published
- 2026-07-14: patched: Upstream fix committed by Andi Shyti
- 2026-07-24: patched: Fix backported to stable tree