CVE-2026-64236: Linux Kernel i2c Davinci DOS Vulnerability

CVE-2026-64236 Overview

CVE-2026-64236 is a division-by-zero vulnerability in the Linux kernel's i2c-davinci driver. The flaw triggers a deterministic kernel panic during driver probe when the clock-frequency device tree property is missing. The DAVINCI_I2C_DEFAULT_BUS_FREQ macro was defined in kHz (100) while the probe function expected Hz, causing integer truncation to zero after division by 1000. The resulting dev->bus_freq = 0 value produced a division-by-zero crash during clock divider calculation. The issue has been resolved in the upstream Linux kernel by redefining the fallback constant in Hz (100000).

Critical Impact
A missing clock-frequency device tree property causes a deterministic kernel panic during i2c-davinci driver probe, resulting in denial of service on affected systems.

Affected Products

Linux kernel with the i2c-davinci driver enabled
Systems using the Davinci I2C controller without a clock-frequency device tree property
Embedded platforms relying on the default fallback bus frequency

Discovery Timeline

2026-07-24 - CVE-2026-64236 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64236

Vulnerability Analysis

The vulnerability resides in the i2c-davinci driver probe function within the Linux kernel. When a device tree omits the clock-frequency property, the driver falls back to the DAVINCI_I2C_DEFAULT_BUS_FREQ macro. This macro was defined with the value 100, representing kilohertz, while the surrounding code assumed hertz.

The probe function performs a division of the input value by 1000 to normalize the bus frequency. Applying that division to the fallback value of 100 produces 0 through integer truncation. The driver then stores this zero into dev->bus_freq and proceeds to compute I2C clock dividers.

Subsequent divider math divides by dev->bus_freq, triggering a division-by-zero exception in the kernel. The result is a deterministic panic during boot on any platform that lacks the clock-frequency property in its device tree.

Root Cause

The root cause is a unit mismatch between the DAVINCI_I2C_DEFAULT_BUS_FREQ macro (defined in kHz) and the device tree property parsing logic (which expects Hz). The mismatch is classified as a Numeric Truncation Error [CWE-197] leading to a Division by Zero condition [CWE-369].

Attack Vector

This is a local, boot-time denial-of-service condition rather than a remotely exploitable flaw. Triggering the panic requires a device tree configuration that omits the clock-frequency property on a platform using the i2c-davinci driver. Attackers with the ability to modify boot configuration or device tree blobs on affected embedded systems could weaponize the flaw to prevent kernel initialization.

The upstream fix redefines DAVINCI_I2C_DEFAULT_BUS_FREQ from 100 to 100000, aligning the fallback value with the expected Hz unit. This preserves the existing division logic while eliminating the truncation-to-zero condition.

Detection Methods for CVE-2026-64236

Indicators of Compromise

Kernel panic messages referencing divide error or division by zero during boot on systems using the i2c-davinci driver.
Boot logs showing dev->bus_freq = 0 or divider calculation failures in the I2C probe path.
Systems failing to complete kernel initialization when the device tree lacks a clock-frequency property for the Davinci I2C node.

Detection Strategies

Audit device tree source (.dts) and blob (.dtb) files for I2C nodes that omit the clock-frequency property.
Compare deployed kernel commits against the fixed hashes 030675aa54cf, 3f43865cb64d, and 9b694bc0e183 to determine patch status.
Review boot logs across embedded device fleets for repeated I2C-related panics matching this signature.

Monitoring Recommendations

Ingest kernel and boot logs into a centralized logging platform to identify recurring panic patterns across embedded assets.
Track kernel package versions on Linux-based edge devices to confirm application of the upstream i2c-davinci patch.
Alert on repeated boot failures or kernel oops events on devices running the Davinci I2C driver.

How to Mitigate CVE-2026-64236

Immediate Actions Required

Apply the upstream Linux kernel patch that redefines DAVINCI_I2C_DEFAULT_BUS_FREQ in Hz.
Update embedded device firmware and kernel images built from affected Davinci I2C sources.
Verify that all device tree files for Davinci I2C controllers include an explicit clock-frequency property as a defense-in-depth measure.

Patch Information

The fix is available in the mainline Linux kernel through three stable branch commits: 030675aa54cf, 3f43865cb64d, and 9b694bc0e183. The patch redefines DAVINCI_I2C_DEFAULT_BUS_FREQ from 100 (kHz) to 100000 (Hz), aligning the fallback with the expected device tree property unit.

Workarounds

Add an explicit clock-frequency property (for example, clock-frequency = <100000>;) to every Davinci I2C node in the device tree to avoid the fallback path entirely.
Rebuild and redeploy device tree blobs on affected embedded systems before the kernel patch can be applied.
Disable the i2c-davinci driver on platforms where the I2C controller is not required until a patched kernel is available.

bash

# Example device tree fragment to avoid the fallback path
i2c0: i2c@1c22000 {
    compatible = "ti,davinci-i2c";
    reg = <0x1c22000 0x1000>;
    clock-frequency = <100000>;
    status = "okay";
};