SB20261103132 - Incorrect behavior order in Linux kernel i2c busses driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect behavior order (CVE-ID: CVE-2026-99248)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger repeated kernel warnings and potentially disrupt system availability.

The vulnerability exists due to incorrect runtime power management teardown ordering in the Xilinx I2C driver when removing a device. A local privileged user can trigger affected device teardown to cause runtime suspension to disable the device clock before managed resource cleanup disables it again, generating repeated kernel warnings.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/47e105bdc863f2b320f9c05c80a63d3b83312700
• https://git.kernel.org/stable/c/d33373c565af9c8a28776af02bd20ba6e5724211