Executive brief
The Linux kernel's i2c-imx driver fails to properly handle SMBus block-read operations with a byte count of 0 or exceeding the maximum allowed value, causing the I2C bus to remain held indefinitely. This prevents legitimate I2C transactions from completing and effectively locks the bus until the system is restarted.
Technical details
The vulnerability exists in the i2c-imx driver's SMBus block-read handling (i2c_imx_read function). When a block read returns a count of 0 (valid per SMBus 3.1 6.5.7) or exceeds I2C_SMBUS_BLOCK_MAX, the driver returns an -EPROTO error without properly releasing the I2C bus. Specifically, it fails to issue a NACK (negative acknowledge) and STOP condition, leaving SDA (serial data line) held and the bus in a locked state. The fix adds TXAK (transmit acknowledge) signaling to NACK the in-flight dummy byte and extends the message length so the existing last-byte handling can emit a proper STOP condition, releasing the bus before reporting the protocol error.
Affected products
- Linux Linux kernel 3.16 and later
Timeline
- 2026-08-15: disclosed
- 2026-08-03: patched