CVE-2026-64278 Overview
CVE-2026-64278 is a race condition in the Linux kernel's i2c-imx-lpi2c driver used on NXP i.MX platforms. During the suspend and resume cycle, a timing window exists between suspend_noirq and full system suspend, and again between resume start and resume_noirq. In this window, the I2C controller's clock and pinctrl resources may be disabled or not yet restored. If a client driver's periodic workqueue triggers an I2C transfer during this interval, the driver accesses I2C registers while the underlying hardware is unavailable, which can hang the system. The fix marks the I2C adapter as suspended during noirq suspend and blocks new transfers until resume completes.
Critical Impact
A periodic I2C workqueue firing during the suspend/resume noirq window can hang the system by accessing an I2C controller whose clock or pinctrl is not available.
Affected Products
- Linux kernel builds for NXP i.MX platforms using the i2c-imx-lpi2c driver
- Systems with I2C client drivers that maintain periodic workqueues issuing I2C transfers
- Stable kernel branches receiving the patches referenced in the upstream commits
Discovery Timeline
- 2026-07-25 - CVE-2026-64278 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64278
Vulnerability Analysis
The defect is a race condition [TOCTOU-class] between the I2C subsystem's power state and pending transfer requests submitted by client drivers. The i2c-imx-lpi2c driver on i.MX SoCs relies on clock and pinctrl resources that the kernel power management framework tears down during the noirq suspend phase and restores during resume. Client drivers that own long-running periodic workqueues do not automatically synchronize with I2C adapter suspend state. A queued work item can enter the transfer path and attempt MMIO accesses against an lpi2c controller whose clock is gated or pinmux is not configured. The result is a stalled bus transaction that can escalate into a full system hang because the noirq phase runs with interrupts disabled and limited recovery capability.
Root Cause
The i2c-imx-lpi2c driver did not mark its adapter as suspended during the noirq phase. As a result, the I2C core continued to accept and dispatch transfer requests initiated by other drivers even though the controller's clock and pinctrl backing had already been released. Register accesses during this window operate on hardware in an undefined state.
Attack Vector
The issue is triggered by legitimate in-kernel workqueue activity during suspend and resume, not by a remote attacker. Reliable reproduction requires a periodic I2C client workload aligned with the suspend/resume noirq window on an affected i.MX platform. There is no published exploit and no evidence of exploitation in the wild.
No verified proof-of-concept code is available. See the upstream fixes in Kernel Git Commit #218cfe3, Kernel Git Commit #5800647, and Kernel Git Commit #b2523f2 for the technical remediation.
Detection Methods for CVE-2026-64278
Indicators of Compromise
- System hangs or unresponsive consoles observed during suspend-to-RAM or resume operations on i.MX hardware
- Kernel log entries referencing the imx-lpi2c driver near the suspend_noirq or resume_noirq transitions
- Watchdog resets correlated with power state transitions on embedded i.MX devices
Detection Strategies
- Inventory kernel builds running on i.MX platforms and confirm whether the i2c-imx-lpi2c driver is present and unpatched
- Correlate dmesg output around power management state changes with hangs reported by field devices
- Review I2C client drivers in your tree for periodic workqueues that do not honor adapter suspend state
Monitoring Recommendations
- Aggregate kernel logs and power management event traces from embedded fleets into a centralized log store for regression analysis
- Track suspend and resume success rates as a reliability signal and alert on regressions after kernel updates
- Monitor upstream stable tree announcements for further backports referencing the three fix commits
How to Mitigate CVE-2026-64278
Immediate Actions Required
- Apply the upstream kernel fix that marks the I2C adapter suspended during noirq suspend and blocks transfers until resume
- Rebase vendor kernels for i.MX products onto a stable release that includes commits 218cfe3, 5800647, and b2523f2
- Audit downstream I2C client drivers to ensure they tolerate a suspended adapter returning -EAGAIN or equivalent
Patch Information
The fix is available in the upstream Linux kernel through the following commits: Kernel Git Commit #218cfe3, Kernel Git Commit #5800647, and Kernel Git Commit #b2523f2. The patch adds a suspended state flag to the adapter during the noirq suspend phase and rejects new transfers until resume restores clock and pinctrl.
Workarounds
- Disable or gate periodic I2C workqueues in client drivers before entering system suspend
- Configure affected devices to avoid suspend-to-RAM cycles until the patched kernel is deployed
- Pin firmware and driver versions on production i.MX fleets to a known-good baseline while patch rollout is scheduled
# Verify the patched commits are present in your kernel source tree
git log --oneline drivers/i2c/busses/i2c-imx-lpi2c.c | \
grep -E '218cfe3|5800647|b2523f2'
# Check the running kernel version on an i.MX target
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
