CVE-2026-64205: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64205 is a logic error vulnerability in the Linux kernel's i2c-i801 (SMBus) driver that can cause a hardware state machine corruption, leading to a system livelock and Hung Task panic. The flaw was discovered during concurrent fuzzing and disclosed on July 20, 2026. It affects Linux kernel versions from 6.3 up to (but not including) the patched commits, with fixed versions available in 6.18.39, 7.1.4, and 7.2-rc1. The CVSS severity is estimated as Medium (GitHub Advisory, Feedly).

The root cause is a logic error (improper resource release) in the error handling path of i801_access() in drivers/i2c/busses/i2c-i801.c. When i801_check_pre() fails — for example, returning -EBUSY because the SMBus controller is held by BIOS/ACPI — the code incorrectly jumps to the out label and unconditionally executes iowrite8(SMBHSTSTS_INUSE_STS | STATUS_FLAGS, SMBHSTSTS(priv)), clearing the INUSE_STS lock and resetting hardware status flags without ever having acquired controller ownership. This corrupts the SMBus hardware state machine, causing all subsequent i801_access() calls to fail at the pre-check stage and triggering a continuous flood of "SMBus is busy, can't use it!" kernel log messages. On systems with slow serial consoles, this printk flood monopolizes the CPU (Console Livelock), starving other processes waiting on the mmap_lock semaphore and ultimately triggering the hung task watchdog. The fix moves the out label below the hardware register cleanup so that iowrite8() is only called when hardware ownership was actually acquired (GitHub Advisory).

Successful exploitation results in a Denial of Service: the SMBus hardware state machine is permanently corrupted for the duration of the session, all subsequent I2C/SMBus operations via the i2c-i801 driver fail, and the system enters a livelock that triggers a hung task watchdog panic, effectively crashing the host. There is no evidence of confidentiality or integrity impact beyond system availability; however, a system crash can disrupt any services or workloads running on the affected host (GitHub Advisory, Feedly).

• Logs: Continuous kernel log messages containing "SMBus is busy, can't use it!" from the i2c-i801 driver, indicating the hardware state machine has been corrupted.
• Logs: Hung task watchdog warnings in dmesg or /var/log/kern.log, showing processes blocked on mmap_lock (down_read semaphore).
• Process: Processes in uninterruptible sleep (D state) visible via ps aux or top, particularly those waiting on I2C/SMBus operations.
• System: System becomes unresponsive or panics with a hung task kernel oops, potentially captured in crash dumps or kdump output.

Apply the upstream Linux kernel patches that move the out label below the hardware register cleanup in i801_access(), ensuring iowrite8() is only called when hardware ownership was actually acquired. Fixed versions are available at kernel commits bb5133a7d5f3, 00904687b9c5, and 10dd1a736d55, corresponding to stable releases 6.18.39, 7.1.4, and 7.2-rc1 respectively. Users should update to a patched kernel version as soon as their distribution makes it available. As a temporary workaround, limiting concurrent access to the SMBus controller or avoiding operations that trigger i801_check_pre() failures may reduce exposure (GitHub Advisory).