CVE-2026-72142None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic (polling) path rejects it as -EPROTO. Wo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic (polling) path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has already started, so the target keeps holding SDA and the bus stays stuck until a power cycle for this i2c controller.
Reading I2DR to obtain the count likewise arms the next byte on the count > I2C_SMBUS_BLOCK_MAX path, which also returned -EPROTO directly and left the bus held.
Handle both: NACK the in-flight dummy byte (TXAK) and extend msgs->len so the existing last-byte handling emits STOP; the dummy byte is discarded. A count of 0 is a valid empty block read; a count above I2C_SMBUS_BLOCK_MAX is still reported as -EPROTO, but only after the bus has been released.
The interrupt-driven path has the same flaw from a later commit and is fixed separately, as it carries a different Fixes: tag and stable range.
Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < 0f29df3c3d607a9dbc14aed0e45504ced4d2e7ecLinux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < 38d4947431b2410850409fda016b2ac9f640a4ddLinux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < e3e8b02d4773cfc5ad561d2e5505efde36c6927aLinux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < 016ef0f6ca4bc9bf0330ac41bd2ea349759643e3Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < c882e8cc68fb993700dc21fd6e754001e6297934Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < 6d2c973926d0612360693bc559be2ffde836151bLinux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < 60ed00d46616a9232e42ea7a3e3c0273d7cf7543Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < cb2fc37857693b55909fb77dc2c87cfbc1cdc476Linux 3.16Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses