CVE-2026-80678

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: Fix slave registration race and error handling

In i2cimxregslave(), the slave pointer was assigned before pmruntimeresumeandget(). If pmruntimeresumeandget() failed, the error path returned without clearing i2cimx->slave, leaving it non-NULL and causing all subsequent registration attempts to fail with -EBUSY.

Additionally, because this driver uses a shared IRQ, the interrupt handler i2cimxisr() can execute concurrently and, after acquiring slavelock, dereference i2cimx->slave. The previous fix attempt added a lockless i2c_imx->slave = NULL on the error path, but that could race with the ISR under the lock and still cause a NULL pointer dereference.

Fix both issues by deferring the assignment of i2cimx->slave and i2cimx->lastslaveevent to after a successful resume, and by performing the assignment inside the slave_lock critical section. This guarantees that the slave pointer is never left stale on the error path and is always valid when observed by the interrupt handler.