Description

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer (i2c_imx_slave_timeout) before the pointer was cleared. If the hrtimer fires after i2c_imx->slave is set to NULL, the timer callback i2c_imx_slave_finish_op() will call i2c_imx_slave_event() with a NULL slave pointer, which results in a use-after-free / NULL pointer dereference. Fix by canceling the hrtimer and waiting for it to complete after disabling interrupts, before clearing the slave pointer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-15T13:17:50.763Z",
  "pubdate": "2026-08-15T13:17:50.763Z",
  "executiveSummary": "A null pointer dereference vulnerability exists in the Linux kernel i2c-imx driver, specifically within the i2c_imx_unreg_slave() function. The vulnerability arises from a race condition between unregistering an I2C slave device and the expiration of a pending high-resolution timer (hrtimer). When an interrupt fires and starts the hrtimer prior to clearing the slave pointer, the subsequent timer callback executes with a null pointer, causing a kernel crash.\nThe primary impact of this vulnerability is a denial of service (DoS) resulting from a kernel panic or system crash due to a null pointer dereference. The affected product is the Linux kernel utilizing the i2c-imx driver. Risk implications include unexpected system reboots and loss of availability for dependent I2C subsystems.\nAttacker capabilities depend on the ability to interact with the underlying hardware driver or trigger specific unregister operations under race-condition-favorable timings. Exploitation requirements involve triggering the unregister sequence while an I2C interrupt and hrtimer are actively pending or firing.",
  "technicalDetails": "The vulnerability is located in the Linux kernel i2c-imx driver, specifically within the i2c_imx_unreg_slave() function and the associated hrtimer callback i2c_imx_slave_finish_op(). The vulnerable component is responsible for managing I2C slave operations and timeouts on i.MX platforms.\nThe root cause of the vulnerability is a synchronization flaw during the unregistration of an I2C slave. In i2c_imx_unreg_slave(), the driver disables interrupts and subsequently sets the internal i2c_imx->slave pointer to NULL. However, a pending hardware interrupt can trigger and start the hrtimer via i2c_imx_slave_timeout before the pointer is explicitly cleared. If the hrtimer fires after the slave pointer has been nulled, the timer callback i2c_imx_slave_finish_op() invokes i2c_imx_slave_event() using the nullified slave pointer.\nThe step-by-step attack flow proceeds as follows: First, an I2C slave is in the process of being unregistered via i2c_imx_unreg_slave(). Second, interrupts are disabled, but a previously pending interrupt initiates the hrtimer (i2c_imx_slave_timeout). Third, the driver clears the i2c_imx->slave pointer to NULL. Fourth, the hrtimer expires, invoking the callback function i2c_imx_slave_finish_op(). Fifth, the callback attempts to dereference the slave pointer to call i2c_imx_slave_event(), resulting in a null pointer dereference.\nAuthentication and privilege requirements depend on local access or the ability to execute code or manipulate driver states within the kernel space. Network exposure is non-existent as this is a local kernel driver vulnerability. The payload behavior involves triggering kernel code execution paths that lead directly to a null pointer dereference, causing immediate kernel panic and denial of service."
}