Skip to main content

Linux Kernel CVE-2026-53340

| EUVDEUVD-2026-40974 MEDIUM
2026-07-01 Linux GHSA-4fhj-6vjr-7222
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Requires a pinctrl_pm_select_sleep_state() failure beyond attacker control during suspend, warranting AC:H; no confidentiality or integrity impact applies.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:51 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: fix clock and pinctrl state inconsistency in runtime PM

In i2c_imx_runtime_suspend(), the clock is disabled before switching the pinctrl state to sleep. If pinctrl_pm_select_sleep_state() fails, the runtime suspend is aborted but the clock remains disabled, causing a system crash when the hardware is subsequently accessed.

Fix this by switching the pinctrl state before disabling the clock so that a pinctrl failure leaves the clock enabled and the hardware accessible.

In i2c_imx_runtime_resume(), restore the pinctrl state back to sleep if clk_enable() fails to keep the consistent.

AnalysisAI

Clock and pinctrl state inconsistency in the Linux kernel's i2c-imx driver causes a system crash on NXP i.MX SoC platforms when runtime power management suspend fails mid-sequence. Specifically, if pinctrl_pm_select_sleep_state() returns an error after the I2C peripheral clock has already been disabled, the kernel leaves the clock off while aborting the suspend - any subsequent hardware access to the I2C controller then triggers a kernel panic, resulting in full system denial of service. No public exploit code exists and EPSS of 0.15% confirms negligible exploitation probability; this is a maintenance-priority patch for embedded Linux maintainers on i.MX hardware, not an enterprise emergency.

Technical ContextAI

The vulnerability resides in drivers/i2c/busses/i2c-imx.c within the Linux kernel, which manages the I2C host controller on NXP/Freescale i.MX application processors (CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*). The runtime PM framework calls i2c_imx_runtime_suspend() to power down the peripheral between transactions; the correct sequence must first transition the pin controller to its sleep state (pinctrl_pm_select_sleep_state), then gate the clock (clk_disable). The defective code reversed this order: it disabled the clock first, then called pinctrl_pm_select_sleep_state(). On error return from the pinctrl call, the suspend is rolled back but the already-disabled clock is not re-enabled, leaving the hardware in an inconsistent state. No CWE is formally assigned, but the root cause maps to CWE-696 (Incorrect Behavior Order) combined with CWE-755 (Improper Handling of Exceptional Conditions) in the error path. A symmetric fix was also required in i2c_imx_runtime_resume() to restore pinctrl to sleep state when clk_enable() fails, preserving consistency across both directions.

RemediationAI

Upgrade to a patched Linux kernel: 7.1, 6.18.36, or 7.0.13, which contain the corrected i2c-imx runtime PM suspend/resume ordering. Upstream fix commits are available at https://git.kernel.org/stable/c/9fa82cf393bafc7bd7ca15c1d5cbd5b57ab9de1d, https://git.kernel.org/stable/c/c8f5269c1bf505847bc7dbb92054594790114de6, and https://git.kernel.org/stable/c/8783fb8031799f1230997c16df8c8dce9fcd1841. For NXP i.MX BSP distributions, verify with the downstream vendor whether the fix has been backported to their supported kernel fork. If immediate patching is not possible, disabling runtime power management for the i2c-imx device - via a device tree property (status = "disabled" on the PM node or setting pm_runtime_disable) or kernel boot parameter - prevents the suspend/resume path from executing entirely, eliminating the vulnerable code path; the trade-off is increased power consumption on battery-operated or power-constrained embedded devices. Cherry-picking the fix commits directly onto an out-of-support kernel branch is also viable for frozen-BSP environments.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53340 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy