CVE-2026-64205

In the Linux kernel, the following vulnerability has been resolved:

i2c: i801: fix hardware state machine corruption in error path

A severe livelock and subsequent Hung Task panic were observed in the

i2c-i801 driver during concurrent Fuzzing. The crash is caused by an

unconditional hardware register cleanup in the error handling path of

i801_access().

When i801_check_pre() fails (e.g., returning -EBUSY because the SMBus

controller is actively used by BIOS/ACPI), the kernel does not actually

acquire the hardware ownership. However, the code jumps to the 'out'

label and executes:

iowrite8(SMBHSTSTS_INUSE_STS | STATUS_FLAGS, SMBHSTSTS(priv));

This forcefully clears the INUSE_STS lock and resets the hardware status

flags without owning the controller. Doing so interrupts ongoing BIOS/ACPI

transactions and totally corrupts the SMBus hardware state machine.

Consequently, all subsequent i801_access() calls fail at the pre-check

stage, triggering an endless stream of "SMBus is busy, can't use it!"

error logs. Over a slow serial console, this printk flood monopolizes

the CPU (Console Livelock), starving other processes trying to acquire

the mmap_lock down_read semaphore, ultimately triggering the hung task

watchdog.

Fix this by moving the 'out' label below the hardware register cleanup.

If i801_check_pre() fails, we safely bypass the iowrite8() and only

release the software locks (pm_runtime and mutex), strictly adhering to

the rule of not releasing resources that were never acquired.