Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-23197

i2c: imx: preserve error state in block data length handler

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: preserve error state in block data length handler When a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX, the length handler sets the state to IMX_I2C_STATE_FAILED. However, i2c_imx_master_isr() unconditionally overwrites this with IMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns buffers and crashes the system. Guard the state transition to preserve error states set by the length handler.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 5f5c2d4579ca6836f5604cca979debd68ecfe23f to < 3f9b508b3eecc00a243edf320bd83834d6a9b482affected
  • 5f5c2d4579ca6836f5604cca979debd68ecfe23f to < b126097b0327437048bd045a0e4d273dea2910ddaffected

Linux Linux

Default version status: affected

  • 6.13affected
  • 0 to < 6.13unaffected
  • 6.18.10 to ≤ 6.18.*unaffected
  • 6.19 to ≤ *unaffected

References