CVE-2026-74463

A flaw was found in the Linux kernel's i2c: jz4780 driver. A severe deadlock can occur between the Common Clock Framework (CCF) and the I2C adapter lock. This happens when an I2C-controlled clock generator client is registered or modified, and a concurrent I2C transfer attempts to acquire a lock already held, creating a circular dependency. This vulnerability can lead to a system freeze, resulting in a Denial of Service (DoS).

A moderate-impact denial-of-service flaw was found in the Linux kernel's i2c-jz4780 driver, which supports the I2C controller of the Ingenic JZ4780 SoC. While an I2C transfer is in progress on this controller, jz4780_i2c_set_speed() calls clk_get_rate() on the host controller's input clock while the I2C adapter bus lock is held. If, at the same time, the Common Clock Framework (CCF) holds its global prepare_lock mutex while performing an I2C access to an I2C-controlled clock generator client (such as an Si5351) on the same bus, an AB/BA circular lock dependency arises between the CCF prepare_lock and the I2C adapter lock. This unresolvable circular wait deadlocks the kernel and can freeze the system, resulting in a denial of service; there is no confidentiality or integrity impact (Red Hat CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). All currently tracked Red Hat products, including every Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt shipping stream, are marked Not Affected with the justification that the vulnerable code is not present in the shipped kernel packages, so no Red Hat product is exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.