CVE-2026-53340: Linux i2c-imx Runtime PM State Inconsistency DoS

Technical summary

The vulnerability is a state management race condition in the IMX I2C driver's runtime PM implementation. In i2c_imx_runtime_suspend(), clk_disable() is called before pinctrl_pm_select_sleep_state(). If pinctrl_pm_select_sleep_state() fails and returns an error, the function returns early, but the clock has already been disabled. Subsequent hardware access attempts crash because the I2C controller clock is gated. The fix inverts the order: pinctrl state is switched first, then the clock is disabled. Additionally, i2c_imx_runtime_resume() is corrected to restore pinctrl to sleep state if clk_enable() fails, maintaining symmetry and preventing a deadlock scenario.

Business impact

Systems relying on IMX-based I2C devices—common in industrial control, automotive, and embedded platforms—may experience unexpected kernel crashes and service interruptions if pinctrl operations fail during power transitions. This can affect uptime-critical deployments such as network infrastructure, automation systems, and IoT gateways. The risk is elevated in environments with power-constrained or thermally-managed hardware where runtime PM is actively used.

Affected systems

The vulnerability affects Linux kernel versions that contain the IMX I2C driver with the vulnerable code path. This includes multiple recent long-term support (LTS) and stable kernel series. Systems using NXP i.MX processors (common in industrial SoCs) are at risk, particularly those relying on the i2c-imx driver for peripherals that require pinctrl-based power state management. Verify the specific kernel version on your systems against the vendor advisory to determine affected releases.

Exploitability

This is not a remotely exploitable vulnerability. The crash is triggered only when the kernel's runtime PM system attempts to suspend the I2C device and encounters a pinctrl state transition failure. Exploitation requires either misconfigured or failing pinctrl hardware/firmware, or deliberate kernel module activity. The impact is local denial of service (system crash), not information disclosure or privilege escalation. The CVSS score of 5.5 (MEDIUM) reflects the local attack vector and availability impact.

Remediation

Apply the upstream kernel patch that reorders the pinctrl state switch before clock disable in i2c_imx_runtime_suspend(), and adds the corresponding pinctrl state restoration in i2c_imx_runtime_resume(). Verify the patch version against your distribution's advisory. Alternatively, disable runtime PM for the I2C device as a temporary workaround if the patch is not yet available for your kernel version.

Patch guidance

Obtain and verify the patch through your Linux distribution's security or kernel update channel. The fix has been merged into the upstream Linux kernel; verify the specific commit hash and kernel version through the distribution's advisory. Apply patches during a scheduled maintenance window with planned I2C device downtime. Test thoroughly on systems with IMX-based I2C hardware before wide deployment to confirm pinctrl state transitions work correctly after patching.

Detection guidance

Monitor kernel logs for messages indicating pinctrl state transition failures (typically logged by the pinctrl subsystem) followed by i2c-imx access errors or kernel panics. Use `dmesg` or journalctl to search for 'pinctrl.*sleep' or 'i2c.*error' patterns. Identify systems running vulnerable kernel versions using kernel version checks or configuration management tools. Runtime PM activity is logged in debugfs under power/runtime_pm statistics if enabled; elevated pm_runtime_resume or pm_runtime_suspend error counts may indicate this issue.

Why prioritize this

Prioritize patching systems that (1) use NXP i.MX processors with I2C peripherals, (2) have runtime PM enabled in the kernel, and (3) run long-term support distributions. Crash risk is high in production automation, gateway, and embedded systems where I2C is essential. The MEDIUM CVSS score reflects availability impact; this is lower urgency than privilege escalation flaws but higher than non-crashing bugs. Schedule patches in the next quarterly or monthly maintenance cycle depending on system criticality.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: AV:L (local attack vector only; no remote trigger), AC:L (low complexity; pinctrl failure can occur naturally), PR:L (requires local access or kernel execution context), UI:N (no user interaction), S:U (no scope change), C:N (no confidentiality impact), I:N (no integrity impact), A:H (high availability impact; system crash). The score does not account for rarity of pinctrl failures or ecosystem impact; it reflects the vulnerability's worst-case technical severity.

Frequently asked questions