Riskcovery

CVE-2026-23197

i2c: imx: preserve error state in block data length handler

State
Published
Severity
Not scored
Published
Feb 14, 2026
Updated
May 11, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: preserve error state in block data length handler

When a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX, the length handler sets the state to IMX_I2C_STATE_FAILED. However, i2c_imx_master_isr() unconditionally overwrites this with IMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns buffers and crashes the system.

Guard the state transition to preserve error states set by the length handler.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 5f5c2d4579ca6836f5604cca979debd68ecfe23f to before 3f9b508b3eecc00a243edf320bd83834d6a9b482Affected
  • 5f5c2d4579ca6836f5604cca979debd68ecfe23f to before b126097b0327437048bd045a0e4d273dea2910ddAffected
LinuxLinux
  • 6.13Affected
  • before 6.13Not affected
  • 6.18.10 through 6.18.*Not affected
  • 6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.