Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64205— i2c: i801: fix hardware state machine corruption in error path

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 6.3版本存在安全漏洞，该漏洞源于i801_access()错误处理路径中对硬件寄存器无条件清理，可能导致控制器在被BIOS/ACPI使用时强制清除INUSE_STS锁并重置状态标志，进而中断正在进行的传输、损坏SMBus硬件状态机，最终引起内核活跃锁及Hung Task崩溃。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.12% · P2

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 1f760b87e54cf56a25ab68f8dc625e339f6e46d5< 2ef69871b313aa0f02182795f5e0f5aa455f203c affected
1f760b87e54cf56a25ab68f8dc625e339f6e46d5< ef5a347532932f58748dad485c15039f5168c377 affected
1f760b87e54cf56a25ab68f8dc625e339f6e46d5< bb5133a7d5f3fe5c387770e25f2e00e682ce11ed affected
1f760b87e54cf56a25ab68f8dc625e339f6e46d5< 00904687b9c5527d569d9a1ca72119823e735a61 affected
1f760b87e54cf56a25ab68f8dc625e339f6e46d5< 10dd1a736d557e310a77117832874729a0175d57 affected
6.3 affected
< 6.3 unaffected
6.6.148≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64205

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
i2c: i801: fix hardware state machine corruption in error path
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during concurrent Fuzzing. The crash is caused by an unconditional hardware register cleanup in the error handling path of i801_access(). When i801_check_pre() fails (e.g., returning -EBUSY because the SMBus controller is actively used by BIOS/ACPI), the kernel does not actually acquire the hardware ownership. However, the code jumps to the 'out' label and executes: iowrite8(SMBHSTSTS_INUSE_STS | STATUS_FLAGS, SMBHSTSTS(priv)); This forcefully clears the INUSE_STS lock and resets the hardware status flags without owning the controller. Doing so interrupts ongoing BIOS/ACPI transactions and totally corrupts the SMBus hardware state machine. Consequently, all subsequent i801_access() calls fail at the pre-check stage, triggering an endless stream of "SMBus is busy, can't use it!" error logs. Over a slow serial console, this printk flood monopolizes the CPU (Console Livelock), starving other processes trying to acquire the mmap_lock down_read semaphore, ultimately triggering the hung task watchdog. Fix this by moving the 'out' label below the hardware register cleanup. If i801_check_pre() fails, we safely bypass the iowrite8() and only release the software locks (pm_runtime and mutex), strictly adhering to the rule of not releasing resources that were never acquired.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 6.3版本存在安全漏洞，该漏洞源于i801_access()错误处理路径中对硬件寄存器无条件清理，可能导致控制器在被BIOS/ACPI使用时强制清除INUSE_STS锁并重置状态标志，进而中断正在进行的传输、损坏SMBus硬件状态机，最终引起内核活跃锁及Hung Task崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1f760b87e54cf56a25ab68f8dc625e339f6e46d5 ~ 2ef69871b313aa0f02182795f5e0f5aa455f203c -
Linux Linux 6.3 -

II. Public POCs for CVE-2026-64205

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64205

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64205 (5)

Same Patch Batch · Linux · 2026-07-20 · 9 CVEs total

CVE-2026-64206 8.8 HIGH Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
CVE-2026-64188 7.8 HIGH net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
CVE-2026-64189 7.8 HIGH netfilter: ipset: fix race between dump and ip_set_list resize
CVE-2026-64191 7.8 HIGH i2c: stub: Reject I2C block transfers with invalid length
CVE-2026-64187 xfs: fail recovery on a committed log item with no regions
CVE-2026-64190 net: team: fix NULL pointer dereference in team_xmit during mode change
CVE-2026-64192 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
CVE-2026-64207 net/sched: dualpi2: fix GSO backlog accounting

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64205

No comments yet

Leave a comment