Linux Kernel: Three Vulnerabilities in I2C, Media, and USB Subsystems Disclosed Together
Three Linux kernel vulnerabilities affecting I2C, media, and USB subsystems were disclosed together on July 25, 2026, with fixes available.
Key findings
- Three Linux kernel vulnerabilities disclosed on July 25, 2026, affecting i2c, media, and USB subsystems.
- CVE-2026-64236: Fixes a division by zero in the i2c: davinci driver due to missing clock-frequency property.
- CVE-2026-64240: Corrects control request handling in the media: rc: igorplugusb driver.
- CVE-2026-64209: Addresses an out-of-bounds array access in the phy: qcom: qmp-usbc driver.
- All vulnerabilities were resolved in the same disclosure event, emphasizing the need for timely kernel updates.
On July 25, 2026, three vulnerabilities in the Linux kernel were disclosed, all patched on the same day. These issues affect various subsystems, including I2C, media, and USB, with potential impacts ranging from division by zero errors to out-of-bounds array accesses.
The first vulnerability, CVE-2026-64236, addresses a division by zero error in the i2c: davinci driver. This occurs when the 'clock-frequency' property is missing from the device tree, causing the driver to fall back to a default value defined in kHz. The fix ensures proper handling of this fallback to prevent crashes.
CVE-2026-64240, related to the media subsystem, specifically the igorplugusb driver, resolves an issue with control request setup packets. A previous commit intended to improve DMA coherency by changing the control request storage, but this introduced a flaw in how the control request setup packet was handled, which is now corrected.
The third vulnerability, CVE-2026-64209, found in the phy: qcom: qmp-usbc driver, involves an out-of-bounds array access. An incorrect boundary check in the DP swing configuration allowed an invalid index to be used, leading to memory corruption. The fix adjusts the check to prevent this out-of-bounds access.
All three vulnerabilities were resolved in the same disclosure event, indicating a coordinated update or a focused effort to address these specific kernel issues. Users are advised to update to patched kernel versions to mitigate these risks.
The timely disclosure and resolution of these three distinct kernel vulnerabilities highlight the ongoing efforts to maintain the security and stability of the Linux kernel. While not linked by a common exploitation vector or threat actor, their simultaneous disclosure underscores the importance of prompt patching for critical system components. Users of Debian-based systems and other distributions utilizing these kernel components should ensure their systems are updated to the latest stable kernel releases.