Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux Kernel I2C Driver: Endless Read Loop Crash
CVE-2026-23197
Summary
A bug in the Linux kernel's I2C driver for certain devices can cause a system crash if a block read operation returns an invalid length. This can happen when the driver incorrectly resets its error state, leading to a buffer overflow and system crash. To fix this, update your Linux kernel to the latest version to prevent potential crashes.
Original title
In the Linux kernel, the following vulnerability has been resolved:
i2c: imx: preserve error state in block data length handler
When a block read returns an invalid length, zero or >I2C_SMBUS_BLO...
Original description
In the Linux kernel, the following vulnerability has been resolved:
i2c: imx: preserve error state in block data length handler
When a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX,
the length handler sets the state to IMX_I2C_STATE_FAILED. However,
i2c_imx_master_isr() unconditionally overwrites this with
IMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns
buffers and crashes the system.
Guard the state transition to preserve error states set by the length
handler.
i2c: imx: preserve error state in block data length handler
When a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX,
the length handler sets the state to IMX_I2C_STATE_FAILED. However,
i2c_imx_master_isr() unconditionally overwrites this with
IMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns
buffers and crashes the system.
Guard the state transition to preserve error states set by the length
handler.
Published: 14 Feb 2026 · Updated: 10 Mar 2026 · First seen: 6 Mar 2026