{"id":6801,"date":"2026-09-04T18:49:17","date_gmt":"2026-09-04T10:49:17","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72141"},"modified":"2026-09-04T18:49:17","modified_gmt":"2026-09-04T10:49:17","slug":"cve-2026-72141","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72141","title":{"rendered":"CVE-2026-72141 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: fix locked"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)<\/p>\n<p>SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the<br \/>\ninterrupt-driven block-read state machine rejects it as -EPROTO. Worse,<br \/>\nit returns without a NACK+STOP: the next receive cycle has already<br \/>\nstarted, so the target keeps holding SDA and the bus stays stuck until a<br \/>\npower cycle of this i2c controller.<\/p>\n<p>Accept count=0: NACK the in-flight dummy byte (TXAK) and set msg-&gt;len to<br \/>\n2 so i2c_imx_isr_read_continue() emits STOP via its normal last-byte<br \/>\npath. The dummy byte is discarded; block-read callers only consume<br \/>\nbuf[0..count-1].<\/p>\n<p>Reading I2DR has likewise already armed the next byte on the<br \/>\ncount &gt; I2C_SMBUS_BLOCK_MAX error path, so NACK it (TXAK) before aborting<br \/>\nwith -EPROTO; otherwise the failing transfer&#8217;s STOP cannot complete and<br \/>\nthe bus stays held.<\/p>\n<p>The atomic path regressed earlier (v3.16) and is fixed separately; this<br \/>\npatch covers only the v6.13 state-machine rework.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)<\/p>\n<p>SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the<br \/>\ninterrupt-dri<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6801","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}