CVE-2026-23055

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> i2c: riic: Move suspend handling to NOIRQ phase<br /> <br /> Commit 53326135d0e0 ("i2c: riic: Add suspend/resume support") added<br /> suspend support for the Renesas I2C driver and following this change<br /> on RZ/G3E the following WARNING is seen on entering suspend ...<br /> <br /> [ 134.275704] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)<br /> [ 134.285536] ------------[ cut here ]------------<br /> [ 134.290298] i2c i2c-2: Transfer while suspended<br /> [ 134.295174] WARNING: drivers/i2c/i2c-core.h:56 at __i2c_smbus_xfer+0x1e4/0x214, CPU#0: systemd-sleep/388<br /> [ 134.365507] Tainted: [W]=WARN<br /> [ 134.368485] Hardware name: Renesas SMARC EVK version 2 based on r9a09g047e57 (DT)<br /> [ 134.375961] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> [ 134.382935] pc : __i2c_smbus_xfer+0x1e4/0x214<br /> [ 134.387329] lr : __i2c_smbus_xfer+0x1e4/0x214<br /> [ 134.391717] sp : ffff800083f23860<br /> [ 134.395040] x29: ffff800083f23860 x28: 0000000000000000 x27: ffff800082ed5d60<br /> [ 134.402226] x26: 0000001f4395fd74 x25: 0000000000000007 x24: 0000000000000001<br /> [ 134.409408] x23: 0000000000000000 x22: 000000000000006f x21: ffff800083f23936<br /> [ 134.416589] x20: ffff0000c090e140 x19: ffff0000c090e0d0 x18: 0000000000000006<br /> [ 134.423771] x17: 6f63657320313030 x16: 2e30206465737061 x15: ffff800083f23280<br /> [ 134.430953] x14: 0000000000000000 x13: ffff800082b16ce8 x12: 0000000000000f09<br /> [ 134.438134] x11: 0000000000000503 x10: ffff800082b6ece8 x9 : ffff800082b16ce8<br /> [ 134.445315] x8 : 00000000ffffefff x7 : ffff800082b6ece8 x6 : 80000000fffff000<br /> [ 134.452495] x5 : 0000000000000504 x4 : 0000000000000000 x3 : 0000000000000000<br /> [ 134.459672] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c9ee9e80<br /> [ 134.466851] Call trace:<br /> [ 134.469311] __i2c_smbus_xfer+0x1e4/0x214 (P)<br /> [ 134.473715] i2c_smbus_xfer+0xbc/0x120<br /> [ 134.477507] i2c_smbus_read_byte_data+0x4c/0x84<br /> [ 134.482077] isl1208_i2c_read_time+0x44/0x178 [rtc_isl1208]<br /> [ 134.487703] isl1208_rtc_read_time+0x14/0x20 [rtc_isl1208]<br /> [ 134.493226] __rtc_read_time+0x44/0x88<br /> [ 134.497012] rtc_read_time+0x3c/0x68<br /> [ 134.500622] rtc_suspend+0x9c/0x170<br /> <br /> The warning is triggered because I2C transfers can still be attempted<br /> while the controller is already suspended, due to inappropriate ordering<br /> of the system sleep callbacks.<br /> <br /> If the controller is autosuspended, there is no way to wake it up once<br /> runtime PM disabled (in suspend_late()). During system resume, the I2C<br /> controller will be available only after runtime PM is re-enabled<br /> (in resume_early()). However, this may be too late for some devices.<br /> <br /> Wake up the controller in the suspend() callback while runtime PM is<br /> still enabled. The I2C controller will remain available until the<br /> suspend_noirq() callback (pm_runtime_force_suspend()) is called. During<br /> resume, the I2C controller can be restored by the resume_noirq() callback<br /> (pm_runtime_force_resume()). Finally, the resume() callback re-enables<br /> autosuspend. As a result, the I2C controller can remain available until<br /> the system enters suspend_noirq() and from resume_noirq().