CVE-2026-72141

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.13

Description An issue exists in the i2c imx driver where the interrupt-driven block-read state machine incorrectly handles a Block Read byte count of 0. In this scenario, the system rejects the request as -EPROTO but fails to return a NACK+STOP. Consequently, the next receive cycle begins prematurely, causing the target to hold the SDA line and locking the bus until the i2c controller is power cycled. Additionally, reading I2DR on the count > I2C SMBUS BLOCK MAX error path arms the next byte, which can also lead to a held bus if not NACKed before aborting with -EPROTO. The i2c imx isr read continue() function is involved in the process of emitting the STOP signal.

Recommendations Update the Linux kernel to version 6.13 or later.