CVE-2026-64171 Linux CVE debrief

Who should care

Linux kernel users and maintainers, as well as security teams and operators responsible for maintaining and securing Linux-based systems, should be aware of this vulnerability and ensure the patch is applied to prevent potential issues with the i2c: tegra component. Additionally, those responsible for vulnerability management, platform security, and affected product deployments should review the patch and assess their exposure.

Technical summary

The vulnerability exists in the Linux kernel's i2c: tegra component. When tegra_i2c_mutex_lock() fails, the function returns without calling pm_runtime_put(), resulting in a leaked runtime PM reference. This prevents the device from entering runtime suspend. A patch has been applied to add the missing pm_runtime_put() call. The patch ensures that the runtime PM reference is properly released, even in the event of a mutex lock failure.

Defensive priority

Medium

Recommended defensive actions

• Apply the patch to fix the pm_runtime leak on mutex_lock failure in the Linux kernel's i2c: tegra component.
• Ensure the Linux kernel is updated with the latest patches.
• Monitor the Linux kernel for future vulnerabilities and updates.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-19T16:17:59.283Z and has not been modified since then. The NVD entry is currently Received. The Linux kernel vulnerability in the i2c: tegra component was patched to fix a pm_runtime leak on mutex_lock failure. Evidence of the vulnerability's existence and impact is limited to the provided CVE and NVD details. Defenders should verify the patch application and monitor for potential issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.