CVE-2026-64205 in Linux
Summary
by MITRE • 07/20/2026
In the Linux kernel, the following vulnerability has been resolved:
i2c: i801: fix hardware state machine corruption in error path
A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during concurrent Fuzzing. The crash is caused by an unconditional hardware register cleanup in the error handling path of i801_access().
When i801_check_pre() fails (e.g., returning -EBUSY because the SMBus controller is actively used by BIOS/ACPI), the kernel does not actually acquire the hardware ownership. However, the code jumps to the 'out' label and executes:
iowrite8(SMBHSTSTS_INUSE_STS | STATUS_FLAGS, SMBHSTSTS(priv));
This forcefully clears the INUSE_STS lock and resets the hardware status flags without owning the controller. Doing so interrupts ongoing BIOS/ACPI transactions and totally corrupts the SMBus hardware state machine.
Consequently, all subsequent i801_access() calls fail at the pre-check stage, triggering an endless stream of "SMBus is busy, can't use it!" error logs. Over a slow serial console, this printk flood monopolizes the CPU (Console Livelock), starving other processes trying to acquire the mmap_lock down_read semaphore, ultimately triggering the hung task watchdog.
Fix this by moving the 'out' label below the hardware register cleanup. If i801_check_pre() fails, we safely bypass the iowrite8() and only release the software locks (pm_runtime and mutex), strictly adhering to the rule of not releasing resources that were never acquired.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability exists within the Linux kernel's i2c-i801 driver which governs SMBus communication through the i801 hardware controller. This flaw manifests as a critical livelock condition that can lead to system hangs and panic states during concurrent operations, particularly when subjected to fuzzing tests. The root cause lies in improper error handling within the i801_access() function where hardware state management becomes corrupted due to premature resource cleanup.
The technical implementation flaw occurs specifically when i801_check_pre() returns an error condition such as -EBUSY indicating that the SMBus controller is currently occupied by BIOS or ACPI components. Under normal circumstances, this should prevent acquisition of hardware ownership and subsequent operations. However, the current code structure executes unconditional hardware register cleanup operations even when no actual hardware ownership has been obtained. The problematic execution path jumps directly to the 'out' label and performs iowrite8() operations that forcibly clear the INUSE_STS lock bit while resetting status flags without proper controller ownership.
This improper hardware state manipulation fundamentally corrupts the SMBus hardware state machine by interrupting ongoing BIOS or ACPI transactions that may be actively using the controller. The corruption creates a cascading failure condition where subsequent i801_access() calls consistently fail during their pre-check stages, generating continuous "SMBus is busy, can't use it!" error messages. The severity escalates as these repeated error logs flood the kernel console output, consuming CPU cycles and creating what is known as Console Livelock behavior.
The operational impact of this vulnerability extends beyond simple functional failure to encompass complete system responsiveness issues. The excessive printk operations monopolize processor resources, preventing other critical kernel processes from acquiring necessary locks such as mmap_lock down_read semaphore. This resource starvation condition ultimately triggers the hung task watchdog mechanism, resulting in system panic and potential data loss. The vulnerability demonstrates a clear violation of proper resource management principles and can be classified under CWE-691 as inadequate protection against resource exhaustion.
The mitigation strategy requires reorganizing the error handling flow by relocating the 'out' label to occur after hardware register cleanup operations. This ensures that iowrite8() operations only execute when actual hardware ownership has been acquired, preventing unauthorized modifications to the SMBus controller state. When i801_check_pre() fails, the code path should safely bypass hardware register cleanup and only release software-level resources such as pm_runtime and mutex locks that were properly acquired. This approach aligns with ATT&CK technique T1490 for resource exhaustion and demonstrates proper defensive programming practices against improper resource management. The fix enforces the fundamental principle that resources should only be released when they have been legitimately acquired, preventing the corruption of shared hardware state between kernel components and external firmware agents.