CVE-2026-64171 Overview
CVE-2026-64171 is a runtime power management (PM) reference leak in the Linux kernel's i2c-tegra driver. When tegra_i2c_mutex_lock() fails, the driver returns early without invoking pm_runtime_put(). The preceding pm_runtime_get_sync() call has already incremented the runtime PM usage counter. The unbalanced counter prevents the device from ever entering runtime suspend, resulting in wasted power and blocked low-power states on affected Tegra platforms.
The issue has been resolved upstream by adding the missing pm_runtime_put() before returning on lock failure.
Critical Impact
The reference leak keeps the I2C controller powered indefinitely after a mutex lock failure, preventing runtime suspend and increasing power consumption on NVIDIA Tegra-based Linux systems.
Affected Products
- Linux kernel versions containing the i2c-tegra driver prior to the fix commits
- NVIDIA Tegra platforms using the mainline I2C Tegra driver
- Downstream distributions shipping the affected kernel revisions
Discovery Timeline
- 2026-07-19 - CVE-2026-64171 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64171
Vulnerability Analysis
The vulnerability resides in the NVIDIA Tegra I2C bus driver (drivers/i2c/busses/i2c-tegra.c). Runtime PM in the Linux kernel uses reference counting to determine when a device can be suspended. Each pm_runtime_get_sync() call must be balanced by a corresponding pm_runtime_put() call.
In the affected code path, the driver acquires a runtime PM reference through pm_runtime_get_sync() before attempting to take an internal mutex via tegra_i2c_mutex_lock(). If the mutex acquisition fails, the function returns an error without releasing the runtime PM reference. The usage counter remains elevated, and the PM core never invokes the driver's suspend callback.
Over repeated failures, the counter continues to grow. The affected I2C controller stays in the active power state indefinitely, defeating the platform's power management strategy.
Root Cause
The root cause is an unbalanced runtime PM reference count on an error path. This is a resource management defect similar to a memory leak but applied to power management state. The function acquires a resource (pm_runtime_get_sync()) at entry and releases it on the success path, but the mutex-failure error path skips the release.
Attack Vector
This defect is a reliability and power-management issue rather than a directly exploitable security boundary. Local conditions that repeatedly trigger tegra_i2c_mutex_lock() failure can cause persistent power drain and prevent the device from entering low-power states. Detailed technical context is available in the upstream fix commit 57cf4e8d and companion commit 8f7ed203.
No verified exploit code is available for this issue. The vulnerability is described in prose only, consistent with the upstream commit message.
Detection Methods for CVE-2026-64171
Indicators of Compromise
- Tegra-based systems where the I2C controller never transitions to runtime-suspended state despite idle periods
- Elevated runtime_active_kids or usage_count values under /sys/devices/.../power/ for the I2C adapter node
- Kernel logs showing repeated tegra_i2c_mutex_lock() failures without corresponding recovery
Detection Strategies
- Inspect the running kernel version and compare against the fixed commits 57cf4e8d and 8f7ed203 in the stable tree
- Audit /sys/kernel/debug/pm_genpd/ and per-device power/runtime_status entries on Tegra hardware to identify controllers stuck in the active state
- Correlate abnormal power consumption on Tegra platforms with I2C driver activity via kernel tracepoints
Monitoring Recommendations
- Enable CONFIG_PM_DEBUG and monitor runtime PM reference counts on I2C devices during QA and production burn-in
- Track kernel version inventory across Tegra fleets and flag kernels lacking the fix commits
- Use ftrace on pm_runtime_* events to detect unbalanced get/put pairs in the i2c-tegra driver
How to Mitigate CVE-2026-64171
Immediate Actions Required
- Update to a Linux kernel release containing commits 57cf4e8d6a57dc2ef5810f4852a23ba4c71b74bb and 8f7ed203b39004c02479a9156089d87d1ac2c1d8
- For custom kernels, backport the one-line addition of pm_runtime_put() on the mutex-lock failure path in i2c-tegra.c
- Rebuild and redeploy kernel images across affected Tegra devices
Patch Information
The fix is available in the upstream stable tree. Refer to the Kernel Git Commit 57cf4e8d and the Kernel Git Commit 8f7ed203 for the exact source changes. Distribution vendors typically fold stable-tree updates into scheduled kernel releases.
Workarounds
- No functional workaround exists at runtime; the reference leak occurs inside kernel code paths that cannot be safely patched from user space
- On systems where the fix cannot be applied immediately, avoid workloads that repeatedly trigger tegra_i2c_mutex_lock() contention or failure
- Schedule periodic reboots on affected Tegra devices to reset the runtime PM counter until the patched kernel is deployed
# Verify running kernel version and check for the fix
uname -r
git -C /path/to/linux log --oneline | grep -E '57cf4e8d|8f7ed203'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
