CVE-2026-72142
i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
Description
In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic (polling) path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has already started, so the target keeps holding SDA and the bus stays stuck until a power cycle for this i2c controller. Reading I2DR to obtain the count likewise arms the next byte on the count > I2C_SMBUS_BLOCK_MAX path, which also returned -EPROTO directly and left the bus held. Handle both: NACK the in-flight dummy byte (TXAK) and extend msgs->len so the existing last-byte handling emits STOP; the dummy byte is discarded. A count of 0 is a valid empty block read; a count above I2C_SMBUS_BLOCK_MAX is still reported as -EPROTO, but only after the bus has been released. The interrupt-driven path has the same flaw from a later commit and is fixed separately, as it carries a different Fixes: tag and stable range.
INFO
Published Date :
Aug. 15, 2026, 6:21 a.m.
Last Modified :
Aug. 17, 2026, 6:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update Linux kernel to the latest version.
- Apply relevant security patches for the kernel.
- Reboot the system after updates.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72142.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72142 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72142
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72142 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72142 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': '016ef0f6ca4bc9bf0330ac41bd2ea349759643e3', 'versionType': 'git'}, {'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': 'c882e8cc68fb993700dc21fd6e754001e6297934', 'versionType': 'git'}, {'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': '6d2c973926d0612360693bc559be2ffde836151b', 'versionType': 'git'}, {'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': '60ed00d46616a9232e42ea7a3e3c0273d7cf7543', 'versionType': 'git'}, {'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': 'cb2fc37857693b55909fb77dc2c87cfbc1cdc476', 'versionType': 'git'}], 'programFiles': ['drivers/i2c/busses/i2c-imx.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc4', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/i2c/busses/i2c-imx.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': '016ef0f6ca4bc9bf0330ac41bd2ea349759643e3', 'versionType': 'git'}, {'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': 'c882e8cc68fb993700dc21fd6e754001e6297934', 'versionType': 'git'}, {'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': '6d2c973926d0612360693bc559be2ffde836151b', 'versionType': 'git'}, {'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': '60ed00d46616a9232e42ea7a3e3c0273d7cf7543', 'versionType': 'git'}, {'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': 'cb2fc37857693b55909fb77dc2c87cfbc1cdc476', 'versionType': 'git'}], 'programFiles': ['drivers/i2c/busses/i2c-imx.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/i2c/busses/i2c-imx.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': '016ef0f6ca4bc9bf0330ac41bd2ea349759643e3', 'versionType': 'git'}, {'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': 'c882e8cc68fb993700dc21fd6e754001e6297934', 'versionType': 'git'}, {'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': '6d2c973926d0612360693bc559be2ffde836151b', 'versionType': 'git'}, {'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': '60ed00d46616a9232e42ea7a3e3c0273d7cf7543', 'versionType': 'git'}, {'status': 'affected', 'version': '8e8782c71595a5ad29e234ce6b3d2fce787fb07a', 'lessThan': 'cb2fc37857693b55909fb77dc2c87cfbc1cdc476', 'versionType': 'git'}], 'programFiles': ['drivers/i2c/busses/i2c-imx.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc4', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/i2c/busses/i2c-imx.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic (polling) path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has already started, so the target keeps holding SDA and the bus stays stuck until a power cycle for this i2c controller. Reading I2DR to obtain the count likewise arms the next byte on the count > I2C_SMBUS_BLOCK_MAX path, which also returned -EPROTO directly and left the bus held. Handle both: NACK the in-flight dummy byte (TXAK) and extend msgs->len so the existing last-byte handling emits STOP; the dummy byte is discarded. A count of 0 is a valid empty block read; a count above I2C_SMBUS_BLOCK_MAX is still reported as -EPROTO, but only after the bus has been released. The interrupt-driven path has the same flaw from a later commit and is fixed separately, as it carries a different Fixes: tag and stable range. Added Reference https://git.kernel.org/stable/c/016ef0f6ca4bc9bf0330ac41bd2ea349759643e3 Added Reference https://git.kernel.org/stable/c/60ed00d46616a9232e42ea7a3e3c0273d7cf7543 Added Reference https://git.kernel.org/stable/c/6d2c973926d0612360693bc559be2ffde836151b Added Reference https://git.kernel.org/stable/c/c882e8cc68fb993700dc21fd6e754001e6297934 Added Reference https://git.kernel.org/stable/c/cb2fc37857693b55909fb77dc2c87cfbc1cdc476