CVE-2026-23197: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23197 is a denial-of-service vulnerability in the Linux kernel's i2c: imx driver caused by improper error state preservation in the block data length handler. When a block read returns an invalid length (zero or greater than I2C_SMBUS_BLOCK_MAX), the length handler sets the state to IMX_I2C_STATE_FAILED, but i2c_imx_master_isr() unconditionally overwrites this with IMX_I2C_STATE_READ_CONTINUE, triggering an endless read loop that overruns buffers and crashes the system. Affected versions span Linux kernel 6.13 through 6.18.9, as well as 6.19 release candidates (rc1–rc8). The vulnerability was published on February 14, 2026, with patches added on March 19, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Kernel Patch 1).

The root cause is classified as CWE-476 (NULL Pointer Dereference), though the primary mechanism is an improper state machine transition in the i2c IMX driver. The i2c_imx_master_isr() interrupt service routine unconditionally sets the driver state to IMX_I2C_STATE_READ_CONTINUE after a block read, overwriting any error state (e.g., IMX_I2C_STATE_FAILED) previously set by the block data length handler when it detects an out-of-range length value. This causes the driver to loop indefinitely, reading data beyond buffer boundaries and ultimately crashing the kernel. Exploitation requires local access with low privileges to interact with the i2c subsystem or trigger the invalid length condition (Feedly, Kernel Patch 1).

Successful exploitation results in a denial-of-service condition: the affected system crashes due to buffer overruns in the i2c IMX driver, causing kernel instability and unavailability of services dependent on the i2c subsystem. There is no confidentiality or integrity impact — the vulnerability is limited to availability (CVSS A:H, C:N, I:N). Systems using NXP i.MX SoCs with the affected kernel versions and i2c SMBus block read operations are at risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability requires local access with low privileges (PR:L), limiting its attack surface. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Apply the upstream Linux kernel patches available at the two patch commits for this CVE, or upgrade to kernel version 6.18.10 or later, which contains the fix (Kernel Patch 1, Kernel Patch 2). As a workaround, restrict local user access to i2c interfaces to authorized users only, reducing the attack surface for low-privileged local attackers. Monitor systems running kernel versions 6.13–6.18.9 for unexpected kernel crashes or instability related to i2c operations (Feedly).

The vulnerability received routine coverage from vulnerability tracking platforms including VulnDB, Vulners, and CVEFeed shortly after publication. A brief technical write-up was published at infinitsec.net, and Tenable added detection via Nessus plugin 299092. No notable vendor statements or significant security community commentary beyond standard tracking have been observed (Feedly, Tenable Nessus).