CVE-2020-36780: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a reference leak vulnerability was discovered in the Spreadtrum I2C controller driver. The vulnerability occurs when pm_runtime_get_sync fails in the sprd_i2c_master_xfer() and sprd_i2c_remove() functions. This issue was fixed in a kernel update, with the vulnerability being assigned CVE-2020-36780 (Kernel Git).

The vulnerability stems from improper handling of PM reference counts in the Spreadtrum I2C controller driver. When pm_runtime_get_sync fails, it still increments the PM reference count, but the code path lacks the corresponding put operation. This results in a reference leak. The fix involves replacing pm_runtime_get_sync with pm_runtime_resume_and_get to ensure the usage counter remains balanced (Kernel Git).

The reference leak could lead to resource exhaustion over time as PM reference counts accumulate without being properly decremented. This could potentially affect system stability and resource management in systems using the Spreadtrum I2C controller (Kernel Git).

The vulnerability has been patched by replacing pm_runtime_get_sync with pm_runtime_resume_and_get in the affected functions. This ensures proper reference counting behavior when operations fail. The fix was implemented in the Linux kernel through commit 3a4f326463117cee3adcb72999ca34a9aaafda93 (Kernel Git).