CVE-2026-64278 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
On some i.MX platforms, certain I2C client drivers keep a periodic workqueue which continues to trigger I2C transfers.
During system suspend/resume, there exists a time window between: - suspend_noirq and the system entering suspend - the system starting to resume and resume_noirq
In this window, the I2C controller resources such as clock and pinctrl may already be disabled or not yet restored.
If a workqueue triggers an I2C transfer in this period, the driver attempts to access I2C registers while the hardware resources are unavailable, which may lead to system hang.
Mark the I2C adapter as suspended during noirq suspend and block new transfers until resume, ensuring that I2C transfers are only issued when hardware resources are available.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability affects the Linux kernel's i2c-imx-lpi2c driver on i.MX platform systems where the I2C controller hardware undergoes power management transitions during system suspend and resume operations. The issue stems from a race condition that occurs in the timing window between suspend_noirq and the actual system suspend state, as well as between the system start of resume and the resume_noirq phase. During these transitional periods, critical hardware resources including clocks and pinctrl configurations may be disabled or not yet restored, creating a scenario where I2C client drivers can attempt to initiate transfers while the underlying hardware is unavailable.
The technical flaw manifests when periodic workqueue operations from I2C client drivers continue executing during system power management transitions. These workqueues maintain scheduled tasks that periodically trigger I2C communication attempts, but they lack proper synchronization with the hardware power state management. When a workqueue task executes during the window where I2C controller resources are unavailable, the driver attempts to access I2C registers directly without considering that the necessary hardware infrastructure has been powered down or is in transition states. This results in system hangs as the driver encounters memory-mapped register accesses to non-existent hardware components.
The operational impact of this vulnerability extends beyond simple system instability to potentially complete system lockups during suspend-resume cycles, which can be particularly problematic in embedded systems and mobile devices where reliable power management is critical for battery life optimization. The vulnerability affects systems that implement the i.MX platform architecture with low power I2C controllers, making it relevant to a broad range of automotive, industrial, and consumer electronics devices that rely on these processors for their operations.
The recommended mitigation strategy involves marking the I2C adapter as suspended during the noirq suspend phase of system power management, effectively blocking new I2C transfer operations until the system has completed its resume sequence. This approach ensures that all I2C transfers are only issued when hardware resources are definitively available and properly configured. The fix implements proper synchronization between the power management subsystem and the I2C driver operations by leveraging the kernel's suspend/resume framework to prevent workqueue execution during critical transitional periods. This solution aligns with security best practices for embedded systems and follows the principle of least privilege in hardware resource access, preventing potentially dangerous memory accesses during power state transitions.
This vulnerability type relates to CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization and CWE-755: Improper Handling of Exceptional Conditions. The issue also maps to ATT&CK technique T1489: System Shutdown/Reboot, as it affects system stability during power management operations. The fix represents a proper implementation of resource state management in kernel drivers and demonstrates the importance of considering power management implications in device driver design, particularly for embedded systems where hardware resources must be carefully managed during transitions between active and low power states.