CVE-2026-80678

A flaw was found in the Linux kernel's i2c: imx driver. A race condition during I2C slave registration and error handling could lead to a NULL pointer dereference. This occurs when the i2c_imx->slave pointer is not properly cleared or assigned, especially if power management operations fail or if the interrupt handler executes concurrently. A local attacker could potentially exploit this to cause a system crash, resulting in a Denial of Service (DoS).

The i2c imx slave registration path can leave the adapter slave pointer in an inconsistent state when pm_runtime_resume_and_get fails after the pointer was already assigned. A shared IRQ handler can run concurrently and observe this pointer while handling slave events, which can lead to a NULL pointer dereference or a stale pointer use depending on timing and client lifetime. For the CVSS the PR:L is used for the paranoid interpretation because delegated device management, container root, or a service account may be able to trigger slave registration or controller resume paths in some deployments, while typical systems are closer to PR:H. The issue is not network reachable and requires local interaction with the I2C controller or its driver control path. Impact is at least local denial of service via kernel crash, with limited confidentiality or integrity impact kept only for the paranoid score because the race touches pointer validity but does not show a clear arbitrary write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.