CVE-2026-74462

A flaw was found in the Linux kernel's i.MX I2C driver. During system suspend and resume, a time window exists where I2C controller resources may be disabled or not yet restored. If a workqueue triggers an I2C transfer during this period, the driver attempts to access unavailable hardware resources, which can lead to a system hang. This vulnerability results in a Denial of Service (DoS).

A low impact flaw was found in the Linux kernel's i.MX I2C driver. During system suspend and resume there is a time window, between suspend_noirq and the system entering suspend and between the system starting to resume and resume_noirq, in which I2C controller resources such as clocks and pinctrl may already be disabled or not yet restored. On some i.MX platforms, certain I2C client drivers keep a periodic workqueue that continues to trigger I2C transfers; if such a transfer is issued in this window, the driver attempts to access I2C registers while the hardware resources are unavailable, which may lead to a system hang, resulting in a denial of service. The flaw is local-only, requires precise timing within a narrow suspend/resume window to trigger, and affects only availability, which is why Red Hat rated the impact as low even though the Red Hat CVSS 3.1 base score is 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, moderate).

The vulnerable code is present in Red Hat Enterprise Linux 10.2 and 10.3 (kernel), and in Red Hat In-Vehicle OS 2.0 and 2.1 (kernel and kernel-ivos-qualcomm components). For these affected streams the fix is currently deferred and will be delivered in a future planned update; the residual risk is a possible system hang during suspend/resume cycles on affected i.MX-based systems. Other Red Hat Enterprise Linux versions and streams (including RHEL 6, 7, 8, 9, and RHEL 10.0) do not contain the vulnerable code and are therefore not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.