---
id: CVE-2026-80678
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  i2c: imx: Fix slave registration race and error handling

  In i2c_imx_reg_slave(), the slave pointer was assigned before
  pm_runtime_resume_and_get()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  i2c: imx: Fix slave registration race and error handling

  In i2c_imx_reg_slave(), the slave pointer was assigned before
  pm_runtime_resume_and_get().  If pm_runtime_resu…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-476
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1 <
    754bc62f72fd64b202462367134ac8ce95b005de
  - >-
    Linux >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1 <
    cfdf6e13518589f911b7eace6ccb788e4ed87397
  - >-
    Linux >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1 <
    b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8
  - >-
    Linux >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1 <
    d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f
  - >-
    Linux >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1 <
    12a4f0950a158d98552cbaeacc35edccd8d975fa
  - >-
    Linux >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1 <
    614ca6594e301ff682999797c2216e9685558a2b
  - >-
    Linux >= f7414cd6923fd7f78e57086fc964ba2dc25db5c1 <
    d64ec362c369bbc33833f7936d5f3a706b0d5c45
  - Linux 5.11
published: '2026-08-28'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:18:05.967'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80678'
references:
  - url: 'https://git.kernel.org/stable/c/12a4f0950a158d98552cbaeacc35edccd8d975fa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/614ca6594e301ff682999797c2216e9685558a2b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/754bc62f72fd64b202462367134ac8ce95b005de'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b9f6f4883b9ac86654e75899d0dbf8a7a96ad5d8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cfdf6e13518589f911b7eace6ccb788e4ed87397'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d64ec362c369bbc33833f7936d5f3a706b0d5c45'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d6748f6802f3eebafaa16a5e5dcfbfb9b3bc173f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80678.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80678'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2525505'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80678'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80678'
  - url: 'https://kernelcve.org/list/?q=CVE-2026-80678'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026082800-CVE-2026-80678-ddd4@gregkh/T
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00142
epssPercentile: 0.03453
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:19:46.218826Z'
scores:
  nvd: 8.4
  vendor: 4.7
ingestedAt: '2026-08-30T04:47:10.331Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: Fix slave registration race and error handling

In i2c_imx_reg_slave(), the slave pointer was assigned before
pm_runtime_resume_and_get().  If pm_runtime_resume_and_get() failed,
the error path returned without clearing i2c_imx->slave, leaving it
non-NULL and causing all subsequent registration attempts to fail
with -EBUSY.

Additionally, because this driver uses a shared IRQ, the interrupt
handler i2c_imx_isr() can execute concurrently and, after acquiring
slave_lock, dereference i2c_imx->slave.  The previous fix attempt
added a lockless i2c_imx->slave = NULL on the error path, but that
could race with the ISR under the lock and still cause a NULL pointer
dereference.

Fix both issues by deferring the assignment of i2c_imx->slave and
i2c_imx->last_slave_event to after a successful resume, and by
performing the assignment inside the slave_lock critical section.
This guarantees that the slave pointer is never left stale on the
error path and is always valid when observed by the interrupt handler.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80678.json)