During Linux kernel suspend and resume cycles on i.MX platforms, an I2C driver can schedule periodic work that performs I2C transfers while the hardware controller’s clock and pinctrl resources are disabled or not yet re‑enabled. If this workqueue triggers during the narrow window between suspend_noirq and the system entering suspend, or between resume and resume_noirq, the driver attempts to access I2C registers that are unavailable, causing the kernel to unconditionally hang. The flaw exhibits a classic lockup behavior and therefore represents a denial of service. The weakness is a misuse of resource state during power management, reflected in CWE-366.

This issue affects all Linux kernel builds that contain the imx I2C adapter driver prior to the patch that marked the adapter as suspended during noirq suspend. It is relevant to all i.MX family devices using Linux, including i.MX6, i.MX7, i.MX8, and later, where the imx I2C controller is used. No explicit version range is listed in the advisory, so any kernel lacking the commit 00d86dd5c2034e0e139e4806137b3b43e07ddd83 is considered vulnerable.

The CVSS base score of 5.5 indicates a moderate impact, and the EPSS score of <1% reflects a very low but nonzero probability of exploitation at the time of analysis. The vulnerability is not in the CISA KEV list. Exploitation would require the attacker to execute code within the kernel or to control an I2C client that triggers a transfer during the suspend window, so the attack vector is inferred to be local privileged code execution. No public exploit is documented, but due to the critical nature of a kernel lockup on embedded systems, administrators should prioritize applying the patch.