SB2026072187 - Improper control of a resource through its lifetime in Linux kernel i2c busses driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64205)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in i801_access() in the i2c-i801 driver when handling an error path after a failed pre-check. A local user can trigger concurrent access to the SMBus controller to cause a denial of service.

The issue occurs when the driver clears SMBus hardware status and ownership state without actually owning the controller, which can corrupt the SMBus hardware state machine and lead to a console livelock and hung task panic.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/00904687b9c5527d569d9a1ca72119823e735a61
• https://git.kernel.org/stable/c/10dd1a736d557e310a77117832874729a0175d57
• https://git.kernel.org/stable/c/bb5133a7d5f3fe5c387770e25f2e00e682ce11ed