Improper control of a resource through its lifetime in Linux kernel - CVE-2026-64205
Published: July 21, 2026
Vulnerability identifier: #VU138910
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64205
CWE-ID: CWE-664
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in i801_access() in the i2c-i801 driver when handling an error path after a failed pre-check. A local user can trigger concurrent access to the SMBus controller to cause a denial of service.
The issue occurs when the driver clears SMBus hardware status and ownership state without actually owning the controller, which can corrupt the SMBus hardware state machine and lead to a console livelock and hung task panic.
Affected software
Linux kernel
How to mitigate CVE-2026-64205
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3