---
id: CVE-2026-72142
title: 'i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)

  SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic
  (polling) path rejects it as -EPROTO. Wo…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a <
    0f29df3c3d607a9dbc14aed0e45504ced4d2e7ec
  - >-
    Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a <
    38d4947431b2410850409fda016b2ac9f640a4dd
  - >-
    Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a <
    e3e8b02d4773cfc5ad561d2e5505efde36c6927a
  - >-
    Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a <
    016ef0f6ca4bc9bf0330ac41bd2ea349759643e3
  - >-
    Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a <
    c882e8cc68fb993700dc21fd6e754001e6297934
  - >-
    Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a <
    6d2c973926d0612360693bc559be2ffde836151b
  - >-
    Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a <
    60ed00d46616a9232e42ea7a3e3c0273d7cf7543
  - >-
    Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a <
    cb2fc37857693b55909fb77dc2c87cfbc1cdc476
  - Linux 3.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:51:58.347338Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:20.925Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72142'
references:
  - url: 'https://git.kernel.org/stable/c/0f29df3c3d607a9dbc14aed0e45504ced4d2e7ec'
  - url: 'https://git.kernel.org/stable/c/38d4947431b2410850409fda016b2ac9f640a4dd'
  - url: 'https://git.kernel.org/stable/c/e3e8b02d4773cfc5ad561d2e5505efde36c6927a'
  - url: 'https://git.kernel.org/stable/c/016ef0f6ca4bc9bf0330ac41bd2ea349759643e3'
  - url: 'https://git.kernel.org/stable/c/c882e8cc68fb993700dc21fd6e754001e6297934'
  - url: 'https://git.kernel.org/stable/c/6d2c973926d0612360693bc559be2ffde836151b'
  - url: 'https://git.kernel.org/stable/c/60ed00d46616a9232e42ea7a3e3c0273d7cf7543'
  - url: 'https://git.kernel.org/stable/c/cb2fc37857693b55909fb77dc2c87cfbc1cdc476'
tags:
  - cve.org
epss: 0.00216
epssPercentile: 0.12153
ingestedAt: '2026-11-06T18:00:12.592Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)

SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic
(polling) path rejects it as -EPROTO. Worse, it returns without a
NACK+STOP: the next receive cycle has already started, so the target
keeps holding SDA and the bus stays stuck until a power cycle for
this i2c controller.

Reading I2DR to obtain the count likewise arms the next byte on the
count > I2C_SMBUS_BLOCK_MAX path, which also returned -EPROTO directly
and left the bus held.

Handle both: NACK the in-flight dummy byte (TXAK) and extend msgs->len so
the existing last-byte handling emits STOP; the dummy byte is discarded.
A count of 0 is a valid empty block read; a count above
I2C_SMBUS_BLOCK_MAX is still reported as -EPROTO, but only after the bus
has been released.

The interrupt-driven path has the same flaw from a later commit and is
fixed separately, as it carries a different Fixes: tag and stable range.

## Affected

- `Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < 0f29df3c3d607a9dbc14aed0e45504ced4d2e7ec`
- `Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < 38d4947431b2410850409fda016b2ac9f640a4dd`
- `Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < e3e8b02d4773cfc5ad561d2e5505efde36c6927a`
- `Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < 016ef0f6ca4bc9bf0330ac41bd2ea349759643e3`
- `Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < c882e8cc68fb993700dc21fd6e754001e6297934`
- `Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < 6d2c973926d0612360693bc559be2ffde836151b`
- `Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < 60ed00d46616a9232e42ea7a3e3c0273d7cf7543`
- `Linux >= 8e8782c71595a5ad29e234ce6b3d2fce787fb07a < cb2fc37857693b55909fb77dc2c87cfbc1cdc476`
- `Linux 3.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.