Improper Check or Handling of Exceptional Conditions in Linux kernel - CVE-2026-72141
Published: August 16, 2026
Vulnerability identifier: #VU143454
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72141
CWE-ID: CWE-703
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper exceptional-condition handling in the i2c-imx SMBus block-read state machine when processing an SMBus block read with a byte count of 0 or an invalid oversized count. A local user can trigger a crafted block-read transaction to cause a denial of service.
The issue can leave the I2C bus stuck because the controller fails to complete the transfer with the required NACK and STOP sequence.
Affected software
Linux kernel
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
How to mitigate CVE-2026-72141
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1