CVE-2026-72142

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)

SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic

(polling) path rejects it as -EPROTO. Worse, it returns without a

NACK+STOP: the next receive cycle has already started, so the target

keeps holding SDA and the bus stays stuck until a power cycle for

this i2c controller.

Reading I2DR to obtain the count likewise arms the next byte on the

count > I2C_SMBUS_BLOCK_MAX path, which also returned -EPROTO directly

and left the bus held.

Handle both: NACK the in-flight dummy byte (TXAK) and extend msgs->len so

the existing last-byte handling emits STOP; the dummy byte is discarded.

A count of 0 is a valid empty block read; a count above

I2C_SMBUS_BLOCK_MAX is still reported as -EPROTO, but only after the bus

has been released.

The interrupt-driven path has the same flaw from a later commit and is

fixed separately, as it carries a different Fixes:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References