CVE-2026-72142 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should be aware of this vulnerability and take steps to patch and prevent similar issues. Affected operators and platforms should review and update their configurations to prevent potential bus locking issues. Vulnerability management and security teams should prioritize patching this vulnerability to prevent potential exploitation. System administrators should monitor system logs for potential bus locking issues and review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Rollback/change windows and source tracking should also be considered to ensure the vulnerability is properly managed. This vulnerability may impact various Linux kernel deployments, and an owner should be assigned for follow-up and verification of affected scope and severity. The official CVE record and NVD detail page should be reviewed to validate affected scope and vendor guidance. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs should be checked for exposed assets that need extra review. The i2c: imx vulnerability can cause a locked bus on SMBus block-read of 0, potentially leading to a stuck bus until a power cycle. Linux kernel maintainers and users should prioritize patching this vulnerability to prevent potential bus locking issues. The CVE record was published on 2026-08-15T06:21:31.827Z and has not been modified since then. The vulnerability has a CVSS score and severity that should be reviewed to determine the impact on affected systems. The Linux kernel vulnerability allows for a locked bus on SMBus block-read of 0, potentially leading to a stuck bus until a power cycle. Evidence is based on official CVE and NVD records, as well as kernel.org references. Further review of system logs and monitoring for potential bus locking issues is recommended. Defensive verification tasks should include checking for similar vulnerabilities in other kernel components and reviewing 7

Technical summary

The Linux kernel vulnerability in i2c: imx allows for a locked bus on SMBus block-read of 0. The atomic path rejects a Block Read byte count of 0 as -EPROTO, but returns without a NACK+STOP, causing the bus to stay stuck. The fix involves handling both NACKing the in-flight dummy byte and extending msgs->len to emit STOP. This vulnerability can be mitigated by applying patches from kernel.org and reviewing Linux kernel configurations to prevent similar issues.

Defensive priority

Linux kernel maintainers and users should prioritize patching this vulnerability to prevent potential bus locking issues.

Recommended defensive actions

• Apply patches from kernel.org to fix the i2c: imx vulnerability
• Review and update Linux kernel configurations to prevent similar issues
• Monitor system logs for potential bus locking issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The Linux kernel vulnerability allows for a locked bus on SMBus block-read of 0, potentially leading to a stuck bus until a power cycle. Evidence is based on official CVE and NVD records, as well as kernel.org references. Further review of system logs and monitoring for potential bus locking issues is recommended. Defensive verification tasks should include checking for similar vulnerabilities in other kernel components and reviewing kernel configurations to prevent similar issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.