What is the CVSS score of EUVD-2026-59654?

EUVD-2026-59654 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-59654?

The NXP i.MX processor family-used in embedded systems across IoT, industrial, and networking products-contains a kernel memory corruption vulnerability in the i2c-imx driver that could permit…. A patch is available.

How to fix or mitigate EUVD-2026-59654?

Within 24 hours, audit your infrastructure to identify all devices running Linux kernel with the i2c-imx driver on NXP i.MX SoCs, prioritizing systems with critical or network-facing functions. Within 7 days, contact your NXP and Linux kernel vendor to obtain the patched kernel version addressing this vulnerability and begin staged deployment on non-critical test systems to validate compatibility. Within 30 days, complete patch rollout to all affected production systems and conduct I2C functional testing to confirm proper operation.

Linux Kernel EUVD-2026-59654

| CVE-2026-74461 HIGH

2026-08-15 Linux

GHSA-9hpv-5pc5-wf9w

Denial Of Service Linux Red Hat Suse

8.4

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition requires precise timing (AC:H); I2C slave registration requires at least user-space privilege with device access (PR:L); local kernel driver scope only (AV:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:34 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.4 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 8.4

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: Cancel hrtimer before clearing slave pointer

In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer (i2c_imx_slave_timeout) before the pointer was cleared. If the hrtimer fires after i2c_imx->slave is set to NULL, the timer callback i2c_imx_slave_finish_op() will call i2c_imx_slave_event() with a NULL slave pointer, which results in a use-after-free / NULL pointer dereference.

Fix by canceling the hrtimer and waiting for it to complete after disabling interrupts, before clearing the slave pointer.

AnalysisAI

NULL pointer dereference and use-after-free in the Linux kernel i2c-imx driver (NXP i.MX SoC family) allows a local attacker or concurrent kernel path to trigger kernel memory corruption during I2C slave unregistration. The race condition in i2c_imx_unreg_slave() permits a pending hrtimer callback to fire after the slave pointer has been cleared, causing i2c_imx_slave_finish_op() to dereference a NULL pointer with potential for privilege escalation or system crash. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Gain local access to i.MX system

Delivery

Exploit

Initiate I2C slave traffic to arm hrtimer

Install

Concurrently call slave unregistration

Race hrtimer fire against NULL pointer clear

Execute

Trigger NULL dereference in kernel context

Impact

Kernel crash (DoS) or memory corruption

Recon

Gain local access to i.MX system

Delivery

Exploit

Initiate I2C slave traffic to arm hrtimer

Install

Concurrently call slave unregistration

Race hrtimer fire against NULL pointer clear

Execute

Trigger NULL dereference in kernel context

Impact

Kernel crash (DoS) or memory corruption

Vulnerability AssessmentAI

Exploitation	Exploitation requires: (1) the target system uses an NXP i.MX SoC with the i2c-imx kernel driver loaded, (2) an I2C slave device is registered via the driver's slave registration interface, and (3) the attacker or a concurrent kernel code path can trigger i2c_imx_unreg_slave() while an I2C interrupt is pending. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) overstates real-world exploitability in two notable ways: first, triggering this race condition requires the ability to register and unregister I2C slaves on i.MX hardware - an operation that in practice requires elevated privileges or physical access, making PR:N likely incorrect; second, AC:L understates the timing precision required to exploit a race between interrupt handling and hrtimer cancellation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local user or kernel module on an NXP i.MX embedded system registers an I2C slave device, then concurrently triggers rapid slave unregistration while the I2C interrupt subsystem is active. If a hardware interrupt arrives and starts the hrtimer immediately before i2c_imx_unreg_slave() clears the slave pointer, the hrtimer fires with a NULL pointer, crashing the kernel or potentially corrupting adjacent memory structures. …
Remediation	The primary fix is upgrading to a patched kernel release: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6 as appropriate for the deployed branch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit your infrastructure to identify all devices running Linux kernel with the i2c-imx driver on NXP i.MX SoCs, prioritizing systems with critical or network-facing functions. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-59654 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59654

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code