{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-64205",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-07-19T15:36:31.769Z",
        "datePublished": "2026-07-20T16:27:53.310Z",
        "dateUpdated": "2026-08-17T04:51:51.900Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-17T04:51:51.900Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: i801: fix hardware state machine corruption in error path\n\nA severe livelock and subsequent Hung Task panic were observed in the\ni2c-i801 driver during concurrent Fuzzing. The crash is caused by an\nunconditional hardware register cleanup in the error handling path of\ni801_access().\n\nWhen i801_check_pre() fails (e.g., returning -EBUSY because the SMBus\ncontroller is actively used by BIOS/ACPI), the kernel does not actually\nacquire the hardware ownership. However, the code jumps to the 'out'\nlabel and executes:\n\n    iowrite8(SMBHSTSTS_INUSE_STS | STATUS_FLAGS, SMBHSTSTS(priv));\n\nThis forcefully clears the INUSE_STS lock and resets the hardware status\nflags without owning the controller. Doing so interrupts ongoing BIOS/ACPI\ntransactions and totally corrupts the SMBus hardware state machine.\n\nConsequently, all subsequent i801_access() calls fail at the pre-check\nstage, triggering an endless stream of \"SMBus is busy, can't use it!\"\nerror logs. Over a slow serial console, this printk flood monopolizes\nthe CPU (Console Livelock), starving other processes trying to acquire\nthe mmap_lock down_read semaphore, ultimately triggering the hung task\nwatchdog.\n\nFix this by moving the 'out' label below the hardware register cleanup.\nIf i801_check_pre() fails, we safely bypass the iowrite8() and only\nrelease the software locks (pm_runtime and mutex), strictly adhering to\nthe rule of not releasing resources that were never acquired."
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/i2c/busses/i2c-i801.c"
                    ],
                    "versions": [
                        {
                            "version": "1f760b87e54cf56a25ab68f8dc625e339f6e46d5",
                            "lessThan": "2ef69871b313aa0f02182795f5e0f5aa455f203c",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "1f760b87e54cf56a25ab68f8dc625e339f6e46d5",
                            "lessThan": "ef5a347532932f58748dad485c15039f5168c377",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "1f760b87e54cf56a25ab68f8dc625e339f6e46d5",
                            "lessThan": "bb5133a7d5f3fe5c387770e25f2e00e682ce11ed",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "1f760b87e54cf56a25ab68f8dc625e339f6e46d5",
                            "lessThan": "00904687b9c5527d569d9a1ca72119823e735a61",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "1f760b87e54cf56a25ab68f8dc625e339f6e46d5",
                            "lessThan": "10dd1a736d557e310a77117832874729a0175d57",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/i2c/busses/i2c-i801.c"
                    ],
                    "versions": [
                        {
                            "version": "6.3",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.3",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.148",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.101",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.39",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.1.4",
                            "lessThanOrEqual": "7.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.3",
                                    "versionEndExcluding": "6.6.148"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.3",
                                    "versionEndExcluding": "6.12.101"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.3",
                                    "versionEndExcluding": "6.18.39"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.3",
                                    "versionEndExcluding": "7.1.4"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.3",
                                    "versionEndExcluding": "7.2"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/2ef69871b313aa0f02182795f5e0f5aa455f203c"
                },
                {
                    "url": "https://git.kernel.org/stable/c/ef5a347532932f58748dad485c15039f5168c377"
                },
                {
                    "url": "https://git.kernel.org/stable/c/bb5133a7d5f3fe5c387770e25f2e00e682ce11ed"
                },
                {
                    "url": "https://git.kernel.org/stable/c/00904687b9c5527d569d9a1ca72119823e735a61"
                },
                {
                    "url": "https://git.kernel.org/stable/c/10dd1a736d557e310a77117832874729a0175d57"
                }
            ],
            "title": "i2c: i801: fix hardware state machine corruption in error path",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}