The Linux kernel’s i2c imx driver incorrectly handles an SMBus block read request with a byte count of zero. When such a request is issued, the driver fails to generate the required NACK+STOP sequence, leaving the target device holding the data line (SDA) and keeping the bus in a locked state until a power cycle of the i2c controller occurs. This results in a denial of service that prevents any further i2c transactions until the controller is reset, potentially halting dependent peripherals or system functions.

The flaw resides in the Linux kernel’s imx i2c driver. Any Linux distribution shipping kernel versions that include the unrevised imx driver is affected. The issue is present in both the atomic (polling) and interrupt‑driven SMBus block read paths. No specific kernel versions are listed, so all releases prior to the commit that applies the fix are vulnerable.

The vulnerability has no publicly documented exploitation and is not listed in CISA’s KEV catalog. The CVSS score is 5.5, indicating a moderate impact, and the EPSS score is <1%, suggesting a low probability of exploitation. Based on the description, it is inferred that the exploit requires the ability to issue an SMBus block read of zero to a device on the i2c bus; this could be performed locally on a device or remotely if the attacker can influence or control a peripheral or the bus itself. The risk is therefore a moderate denial of service threat in environments where critical I2C functionality is used, particularly in embedded systems and automotive platforms.