---
id: CVE-2026-64205
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  i2c: i801: fix hardware state machine corruption in error path

  A severe livelock and subsequent Hung Task panic were observed in the
  i2c-i801 driver during concurrent …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  i2c: i801: fix hardware state machine corruption in error path

  A severe livelock and subsequent Hung Task panic were observed in the
  i2c-i801 driver during concurrent …
severity: none
published: '2026-07-20'
updated: '2026-08-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64205'
references:
  - url: 'https://git.kernel.org/stable/c/00904687b9c5527d569d9a1ca72119823e735a61'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/10dd1a736d557e310a77117832874729a0175d57'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2ef69871b313aa0f02182795f5e0f5aa455f203c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bb5133a7d5f3fe5c387770e25f2e00e682ce11ed'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ef5a347532932f58748dad485c15039f5168c377'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00125
epssPercentile: 0.01905
ingestedAt: '2026-08-03T10:24:20.624Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

i2c: i801: fix hardware state machine corruption in error path

A severe livelock and subsequent Hung Task panic were observed in the
i2c-i801 driver during concurrent Fuzzing. The crash is caused by an
unconditional hardware register cleanup in the error handling path of
i801_access().

When i801_check_pre() fails (e.g., returning -EBUSY because the SMBus
controller is actively used by BIOS/ACPI), the kernel does not actually
acquire the hardware ownership. However, the code jumps to the 'out'
label and executes:

    iowrite8(SMBHSTSTS_INUSE_STS | STATUS_FLAGS, SMBHSTSTS(priv));

This forcefully clears the INUSE_STS lock and resets the hardware status
flags without owning the controller. Doing so interrupts ongoing BIOS/ACPI
transactions and totally corrupts the SMBus hardware state machine.

Consequently, all subsequent i801_access() calls fail at the pre-check
stage, triggering an endless stream of "SMBus is busy, can't use it!"
error logs. Over a slow serial console, this printk flood monopolizes
the CPU (Console Livelock), starving other processes trying to acquire
the mmap_lock down_read semaphore, ultimately triggering the hung task
watchdog.

Fix this by moving the 'out' label below the hardware register cleanup.
If i801_check_pre() fails, we safely bypass the iowrite8() and only
release the software locks (pm_runtime and mutex), strictly adhering to
the rule of not releasing resources that were never acquired.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.