CVE-2026-74463
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A severe AB/BA deadlock between the Common Clock Framework (CCF) and the I2C adapter lock in the Linux kernel's jz4780 driver has been fixed. The issue occurred when an I2C-controlled clock generator client (e.g., Si5351) changed frequency while a parallel transfer on the same bus called clk_get_rate() in the active transfer path, causing a system freeze. The fix caches the static host clock rate during probe and uses it in jz4780_i2c_set_speed(), removing the dependency on CCF internal locks during transfers.
Risk Assessment
The risk is a potential complete system hang (deadlock) when using I2C to control clock generators (e.g., Si5351) on platforms with the jz4780 controller. An attacker or hardware fault could trigger conditions leading to system unresponsiveness, impacting service availability.
Recommendation
Apply the official Linux kernel patch containing this fix as soon as possible and update the system to a patched kernel version. Monitor distribution security advisories for updated kernel packages.
Other vulnerabilities in Linux kernel
See all- CVE-2026-80577Unknown
In the Linux kernel's drm/panthor driver, panthor_fw_load_section_entry() skips BO creation for zero-sized firmware sections but adds them to the section list, leading to NULL pointer dereference in later paths. The fix skips adding such sections to the list.
- CVE-2026-80571Unknown
In the Linux kernel powerpc/pseries papr-phy-attest, missing validation of cmd.length could lead to buffer overflow. The fix adds length checks and fixes memory leaks on error paths.
- CVE-2026-80567Unknown
In the Linux kernel Synaptics RMI4 driver (F54), worker errors were not propagated to the V4L2 queue, causing stale or uninitialized data to be delivered to userspace. The fix adds error checking and marks buffers as error state.
- CVE-2026-80566Unknown
In the Linux kernel, the hynitron_cstxxx driver improperly validated touch count and finger IDs. This can lead to corrupted touch state or out-of-bounds buffer access.
- CVE-2026-80564Unknown
In the Linux kernel, the gve driver lacks an implementation of adjfine, leading to a NULL pointer dereference when triggered from userspace, e.g., via testptp.
- CVE-2026-80563Unknown
A use-after-free vulnerability was found in the Linux kernel's gpio-sloppy-logic-analyzer driver. The 'trigger' debugfs file lacked proper protection, allowing a write to freed memory during device unbind. The issue was fixed by using debugfs_create_file() instead of debugfs_create_file_unsafe().
- CVE-2026-80543Unknown
In the Linux kernel, the xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() functions for s390/zcrypt copy a user space message into a kernel buffer based on length, but further processing assumes 4-byte alignment. As a result, up to 3 bytes of uninitialized kernel memory are forwarded to further processing, potentially exposing kernel memory to the crypto card firmware.
- CVE-2026-80542Unknown
In the Linux kernel, the amdgpu driver for AMD Display has a NULL pointer dereference in amdgpu_dm_crtc_set_vblank() when vblank is enabled or queried before a stream is attached to acrtc_state->stream. This can lead to a system crash.
- CVE-2026-80535Unknown
In the Linux kernel XFS filesystem, during directory tree repair, a self-referential directory may be detected. In such a case, the repair code attempts to lock the same inode twice (double iolock/ilock), leading to a deadlock. The fix detects this corner case and handles it appropriately.
- CVE-2026-80533Unknown
In the Linux kernel XFS filesystem, during AGI repair, the function xrep_iunlink_walk_ondisk_bucket may attempt to use the pointer sc->sa.agi_bp, which can be null if the buffer verifier fails. The fix uses ragi->agi_bp instead, which skips verifier checks, to avoid walking off the end of memory.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Fix a severe AB/BA deadlock between the Common Clock Framework (CCF) and the I2C adapter lock, which triggers when an I2C-controlled clock generator client (like the Si5351) is registered or modified under the CCF. During an i2c client clock (generator) frequency change, the CCF acquires its global 'prepare_lock' mutex and the driver calls i2c_transfer() to update the client's chip registers, stalling for the adapter's I2C bus lock. Concurrently, an independent, parallel transfer on the same bus (e.g., a GPIO expander handling LEDs) can hold the I2C adapter lock. Inside this parallel transfer path, jz4780_i2c_set_speed() calls clk_get_rate() on the host controller's input clock to calculate bus timings. This call attempts to acquire the blocked CCF 'prepare_lock', creating a circular dependency that freezes the system. The jz4780 host controller clock itself is static and never changes at runtime. However, calling clk_get_rate() inside the active transfer path introduces an unnecessary dependency on the CCF internal locks. Eliminate this synchronous clk_get_rate() call from the active transfer path by caching the static host peripheral clock rate once - inside the private jz4780_i2c structure during jz4780_i2c_probe(). Update jz4780_i2c_set_speed() to use this cached value, safely decoupling active I2C transactions from the CCF internal locks without any risk of stale timings. Assisted-by web based Google AI (pinpointing the bug and writing the message).