CVE-2026-64205 Overview
CVE-2026-64205 is a Linux kernel vulnerability in the i2c-i801 SMBus controller driver. The flaw allows a local attacker to trigger a hardware state machine corruption through concurrent fuzzing of the SMBus interface. The defect resides in the error-handling path of i801_access(), where an unconditional hardware register cleanup executes even when hardware ownership was never acquired. Exploitation results in a console livelock and eventual hung task panic, producing a denial of service condition on affected systems.
Critical Impact
Concurrent access to the SMBus controller can corrupt the hardware state machine, generating an unbounded stream of kernel error messages that starve mmap_lock readers and trigger the hung task watchdog, resulting in a system-wide denial of service.
Affected Products
- Linux kernel versions containing the vulnerable i2c-i801 driver prior to the fix commits
- Systems using Intel SMBus controllers managed by the i2c-i801 module
- Platforms where BIOS/ACPI actively arbitrates SMBus transactions alongside the kernel driver
Discovery Timeline
- 2026-07-20 - CVE-2026-64205 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64205
Vulnerability Analysis
The vulnerability affects the Intel i2c-i801 SMBus driver in the Linux kernel. During concurrent SMBus operations, the driver's error path releases hardware resources it never acquired, corrupting the controller's state machine and cascading into a denial of service.
When i801_check_pre() fails with -EBUSY because the BIOS or ACPI firmware is actively using the SMBus controller, the driver has not obtained hardware ownership. Despite this, control flow jumps to the out label and executes iowrite8(SMBHSTSTS_INUSE_STS | STATUS_FLAGS, SMBHSTSTS(priv)). This write forcibly clears the INUSE_STS lock bit and resets the status flags on hardware the driver does not own.
The write interrupts in-flight BIOS/ACPI transactions and leaves the SMBus controller in an inconsistent state. All subsequent i801_access() calls fail the pre-check and emit a "SMBus is busy, can't use it!" error message. On systems with a slow serial console, the resulting printk flood monopolizes CPU time, starving processes waiting on the mmap_lock semaphore and eventually triggering the hung task watchdog panic.
Root Cause
The defect is a resource-release ordering error in the error-handling path. The out label sits above the hardware register cleanup, causing the driver to release resources — specifically the INUSE_STS hardware lock — that were never acquired in the failing code path. This violates the fundamental rule that error paths must only unwind state that was successfully established.
Attack Vector
A local unprivileged attacker can trigger the condition by issuing concurrent SMBus operations while the platform firmware is also actively using the controller. Fuzzing the i2c-dev or SMBus interfaces reliably reproduces the corruption. The result is a self-sustaining error loop that renders the system unresponsive and requires a reboot to recover.
No verified proof-of-concept code is published. The vulnerability is described in the upstream kernel commit messages. See the Kernel Git Commit bb5133a7 for the authoritative technical description.
Detection Methods for CVE-2026-64205
Indicators of Compromise
- Repeated kernel log entries matching "SMBus is busy, can't use it!" emitted at high frequency from the i2c-i801 driver
- Hung task watchdog messages naming processes blocked on down_read of mmap_lock
- Serial console output saturation coinciding with unresponsive user-space processes on hosts with Intel SMBus controllers
Detection Strategies
- Parse dmesg and /var/log/kern.log for bursts of i2c-i801 busy errors exceeding a normal baseline rate
- Correlate SMBus error floods with khungtaskd warnings to identify livelock conditions in progress
- Inventory kernel versions across the fleet and flag hosts running builds that predate the fix commits 00904687, 10dd1a73, and bb5133a7
Monitoring Recommendations
- Alert on sustained kernel log volume from a single subsystem, which is a leading indicator of console livelock
- Track khungtaskd events and blocked-task counts through node exporters or in-agent telemetry
- Monitor CPU time consumed by kernel threads handling console I/O on servers equipped with slow serial consoles
How to Mitigate CVE-2026-64205
Immediate Actions Required
- Apply the upstream kernel patches referenced in commits 00904687, 10dd1a73, and bb5133a7 or update to a distribution kernel that includes them
- Restrict access to /dev/i2c-* device nodes to trusted administrators only, removing group-write permissions where present
- Reduce kernel log verbosity for the i2c subsystem on hosts that cannot be patched immediately to limit console livelock exposure
Patch Information
The fix moves the out label below the hardware register cleanup in i801_access(). When i801_check_pre() fails, execution now bypasses the iowrite8() call and only releases the software locks — pm_runtime and the mutex — that were actually acquired. The corrected commits are available at Kernel Git Commit 00904687, Kernel Git Commit 10dd1a73, and Kernel Git Commit bb5133a7.
Workarounds
- Blacklist the i2c_i801 module on systems that do not require userspace SMBus access, preventing exposure of the vulnerable code path
- Disable or throttle the serial console on production servers to eliminate the console-livelock amplification factor
- Enforce mandatory access controls through SELinux or AppArmor policies that prevent unprivileged processes from opening i2c-dev character devices
# Configuration example: blacklist the vulnerable module
echo "blacklist i2c_i801" | sudo tee /etc/modprobe.d/blacklist-i2c-i801.conf
sudo update-initramfs -u
# Restrict access to i2c device nodes
sudo chmod 600 /dev/i2c-*
sudo chown root:root /dev/i2c-*
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
