CVE-2026-74461

Summary (CVE-2026-74461) In the Linux kernel’s i2c_imx driver, the failure path occurs when an interrupt-driven hrtimer can fire after the slave pointer is set to NULL but before the pointer is cleared, leading to a use-after-free/NULL pointer dereference in the timer callback (i2c_imx_slave_fini...

CVE-2026-74461 i2c: imx: Cancel hrtimer before clearing slave pointer

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-72479

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read errors in mma8452read Currently, If i2csmbusreadi2cblockdata fails but mma8452setruntimepmstate succeeds, mma8452read returns 0. As a result, the caller mma8452readraw assumes the read was...

CVE-2026-72481

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2csmbusreadi2cblockdataoremulated...

CVE-2026-72479

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read errors in mma8452read Currently, If i2csmbusreadi2cblockdata fails but mma8452setruntimepmstate succeeds, mma8452read returns 0. As a result, the caller mma8452readraw assumes the read was...

CVE-2026-72391

In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free miibus in sfpi2cmdiobusdestroy sfpi2cmdiobuscreate allocates the I2C MDIO bus with mdioi2calloc, a plain non-devm allocation, and registers it. sfpi2cmdiobusdestroy only unregisters the bus and clears sfp-i2cm...

UBUNTU-CVE-2026-72479

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read errors in mma8452read Currently, If i2csmbusreadi2cblockdata fails but mma8452setruntimepmstate succeeds, mma8452read returns 0. As a result, the caller mma8452readraw assumes the read was...

UBUNTU-CVE-2026-72481

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2csmbusreadi2cblockdataoremulated...

CVE-2026-72268

In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: fix potential memory leak in tdfxfbprobe In tdfxfbprobe, the memory allocated for modelist using fbvideomodetomodelist when CONFIGFB3DFXI2C is defined, is not freed in the subsequent error paths. Fix that by callin...

CVE-2026-72141

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

CVE-2026-72140

In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: Fix use-after-free in mlxbfi2cinitresource If devmplatformgetandioremapresource returns an error, mlxbfi2cinitresource frees tmpres before reading tmpres-io to get the error code. This results in a use-after-free. Sav...

CVE-2026-72142

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 atomic SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic polling path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has...

CVE-2026-72142

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 atomic SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic polling path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has...

CVE-2026-72141

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

UBUNTU-CVE-2026-72141

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

UBUNTU-CVE-2026-72140

In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: Fix use-after-free in mlxbfi2cinitresource If devmplatformgetandioremapresource returns an error, mlxbfi2cinitresource frees tmpres before reading tmpres-io to get the error code. This results in a use-after-free. Sav...

CVE-2026-72140

In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: Fix use-after-free in mlxbfi2cinitresource If devmplatformgetandioremapresource returns an error, mlxbfi2cinitresource frees tmpres before reading tmpres-io to get the error code. This results in a use-after-free. Sav...

UBUNTU-CVE-2026-72268

In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: fix potential memory leak in tdfxfbprobe In tdfxfbprobe, the memory allocated for modelist using fbvideomodetomodelist when CONFIGFB3DFXI2C is defined, is not freed in the subsequent error paths. Fix that by callin...

UBUNTU-CVE-2026-72142

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 atomic SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic polling path rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next receive cycle has...