The i2c-i801 driver contains an error path that writes to the SMBus controller’s INUSE bit and clears status flags even when the controller is not owned, leading to corruption of the controller’s hardware state machine. The resulting printk flood consumes CPU time and triggers the hung task watchdog, which brings the entire kernel to a halt. The weakness is a misuse of lock handling (CWE‑826).

All Linux kernel versions that include the i2c‑i801 driver and have not yet integrated the upstream fix are affected. This includes any distribution kernel that implements Intel PCH SMBus support. The vulnerability applies regardless of architecture, as it is inherent to the driver logic.

The EPSS score is < 1 % and the vulnerability is not listed in KEV, indicating a low probability of exploitation in the wild. The CVSS score of 5.5 shows moderate severity; the impact is a system hang. The attack scenario likely involves a condition where the SMBus controller is busy, as described in the defect, but the CVE does not provide evidence that an attacker can easily create this state. Based on the description, such a condition is inferred from the code path, yet exploitability remains undocumented, so the overall risk is moderate with severe potential damage if triggered.