CVE-2026-23197
published 2026-02-14CVE-2026-23197: In the Linux kernel, the following vulnerability has been resolved: i2c: imx: preserve error state in block data length handler When a block read returns an…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.10%
1.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
i2c: imx: preserve error state in block data length handler
When a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX,
the length handler sets the state to IMX_I2C_STATE_FAILED. However,
i2c_imx_master_isr() unconditionally overwrites this with
IMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns
buffers and crashes the system.
Guard the state transition to preserve error states set by the length
handler.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.18.10-1 (forky) | linux 6.18.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 5f5c2d4579ca6836f5604cca979debd68ecfe23f < 3f9b508b3eecc00a243edf320bd83834d6a9b482 | 3f9b508b3eecc00a243edf320bd83834d6a9b482 |
| linux | linux | >= 5f5c2d4579ca6836f5604cca979debd68ecfe23f < b126097b0327437048bd045a0e4d273dea2910dd | b126097b0327437048bd045a0e4d273dea2910dd |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.18.10-1 | 6.18.10-1 |
| linux | linux_kernel | >= 6.13 < 6.18.10 | 6.18.10 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.18.9 i2c i2c_imx_master_isr buffer overflow (Nessus ID 299092 / WID-SEC-2026-0421)
vuldb·2026-05-05·CVSS 5.5
CVE-2026-23197 [MEDIUM] Linux Kernel up to 6.18.9 i2c i2c_imx_master_isr buffer overflow (Nessus ID 299092 / WID-SEC-2026-0421)
A vulnerability described as critical has been identified in Linux Kernel up to 6.18.9. The impacted element is the function i2c_imx_master_isr of the component i2c. Executing a manipulation can lead to buffer overflow.
This vulnerability appears as CVE-2026-23197. The attacker needs to be present on the local network. There is no available exploit.
Upgrading the affected component is recommended.
OSV
CVE-2026-23197: In the Linux kernel, the following vulnerability has been resolved: i2c: imx: preserve error state in block data length handler When a block read retu
osv·2026-02-14·CVSS 5.5
CVE-2026-23197 [MEDIUM] CVE-2026-23197: In the Linux kernel, the following vulnerability has been resolved: i2c: imx: preserve error state in block data length handler When a block read retu
In the Linux kernel, the following vulnerability has been resolved: i2c: imx: preserve error state in block data length handler When a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX, the length handler sets the state to IMX_I2C_STATE_FAILED. However, i2c_imx_master_isr() unconditionally overwrites this with IMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns buffers and crashes the system. Guard the state transition to preserve error states set by the length handler.
GHSA
GHSA-hp2v-w3xq-4jvv: In the Linux kernel, the following vulnerability has been resolved:
i2c: imx: preserve error state in block data length handler
When a block read re
ghsa_unreviewed·2026-02-14
CVE-2026-23197 [MEDIUM] CWE-476 GHSA-hp2v-w3xq-4jvv: In the Linux kernel, the following vulnerability has been resolved:
i2c: imx: preserve error state in block data length handler
When a block read re
In the Linux kernel, the following vulnerability has been resolved:
i2c: imx: preserve error state in block data length handler
When a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX,
the length handler sets the state to IMX_I2C_STATE_FAILED. However,
i2c_imx_master_isr() unconditionally overwrites this with
IMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns
buffers and crashes the system.
Guard the state transition to preserve error states set by the length
handler.
Red Hat
kernel: Linux kernel i2c-imx driver: Denial of Service via invalid I2C block data length handling
vendor_redhat·2026-02-14·CVSS 5.5
CVE-2026-23197 [MEDIUM] CWE-835 kernel: Linux kernel i2c-imx driver: Denial of Service via invalid I2C block data length handling
kernel: Linux kernel i2c-imx driver: Denial of Service via invalid I2C block data length handling
In the Linux kernel, the following vulnerability has been resolved:
i2c: imx: preserve error state in block data length handler
When a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX,
the length handler sets the state to IMX_I2C_STATE_FAILED. However,
i2c_imx_master_isr() unconditionally overwrites this with
IMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns
buffers and crashes the system.
Guard the state transition to preserve error states set by the length
handler.
A flaw was found in the Linux kernel's i2c-imx driver. A local attacker could exploit a vulnerability in the block data length handler. When an I2C block read returns an invalid length, th
Debian
CVE-2026-23197: linux - In the Linux kernel, the following vulnerability has been resolved: i2c: imx: p...
vendor_debian·2026·CVSS 5.5
CVE-2026-23197 [MEDIUM] CVE-2026-23197: linux - In the Linux kernel, the following vulnerability has been resolved: i2c: imx: p...
In the Linux kernel, the following vulnerability has been resolved: i2c: imx: preserve error state in block data length handler When a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX, the length handler sets the state to IMX_I2C_STATE_FAILED. However, i2c_imx_master_isr() unconditionally overwrites this with IMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns buffers and crashes the system. Guard the state transition to preserve error states set by the length handler.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.18.10-1)
sid: resolved (fixed in 6.18.10-1)
trixie: resolved
No detection rules found.
No public exploits indexed.
2026-02-14
Published