CVE-2026-23197

{"id": "CVE-2026-23197", "cveTags": [], "metrics": {}, "published": "2026-02-14T17:15:57.540", "references": [{"url": "https://git.kernel.org/stable/c/3f9b508b3eecc00a243edf320bd83834d6a9b482", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b126097b0327437048bd045a0e4d273dea2910dd", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: preserve error state in block data length handler\n\nWhen a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX,\nthe length handler sets the state to IMX_I2C_STATE_FAILED. However,\ni2c_imx_master_isr() unconditionally overwrites this with\nIMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns\nbuffers and crashes the system.\n\nGuard the state transition to preserve error states set by the length\nhandler."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ni2c: imx: preservar el estado de error en el manejador de longitud de datos de bloque\n\nCuando una lectura de bloque devuelve una longitud no v\u00e1lida, cero o >I2C_SMBUS_BLOCK_MAX, el manejador de longitud establece el estado a IMX_I2C_STATE_FAILED. Sin embargo, i2c_imx_master_isr() sobrescribe incondicionalmente esto con IMX_I2C_STATE_READ_CONTINUE, causando un bucle de lectura infinito que desborda los b\u00faferes y bloquea el sistema.\n\nProteger la transici\u00f3n de estado para preservar los estados de error establecidos por el manejador de longitud."}], "lastModified": "2026-02-18T17:52:22.253", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}