{"id":"CVE-2026-99248","kind":"vulnerability","aliases":["CVE-2026-99248"],"related":[],"title":"Linux kernel I2C xiic driver: clock warning flood on teardown","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: xiic: restore non-managed runtime PM to fix clk WARN flood\n\nThe devres conversion replaced manual pm_runtime_enable()/disable() with\ndevm_pm_runtime_set_active_enabled() and dropped the remove-time runtime\nPM teardown. The managed release tears runtime PM down in the wrong\norder: it calls pm_runtime_dont_use_autosuspend() before\npm_runtime_disable(), i.e. while runtime PM is still enabled, and devres\nis LIFO so the devm_clk_get_enabled() release runs afterwards.\n\nAt remove(), pm_runtime_put_sync() leaves the device active with the\nautosuspend timer armed. Clearing use_autosuspend then makes rpm_idle()\nsuspend immediately, and xiic_i2c_runtime_suspend() clk_disable()s the\nclock. The later devm_clk_get_enabled() release clk_disable_unprepare()s\nthe already-disabled clock, so clk_core_disable() WARNs (\"clkN already\ndisabled\") on every teardown.\n\nDrop the managed helper and restore the non-managed runtime PM setup and\nteardown, so runtime PM is enabled once in probe and disabled once in\nremove and the clock enable count stays balanced.\n\nOrder the remove teardown so runtime PM is disabled before the usage\ncount is dropped: pm_runtime_disable() followed by pm_runtime_put_noidle()\ninstead of pm_runtime_put_sync(). Dropping the count first with autosuspend\nstill enabled arms the autosuspend timer, and a preemption before\npm_runtime_disable() lets it expire, suspend the device and clk_disable()\nthe clock, which the devm release then disables again - the same WARN.\n\nRestore the non-managed IRQ request as well. The probe error paths now\nunwind runtime PM by hand via goto, and a devm-registered handler is only\nfreed later during devres unwind, so it would stay live across the manual\nteardown (and across any future failing step added after it). Request the\nIRQ with request_threaded_irq() and free it explicitly in the probe error\npath and in remove. The probe error path also clears use_autosuspend, to\nmatch the teardown in remove().","summary":"A bug in the Linux kernel's xiic I2C controller driver tears down runtime power management in the wrong order on removal, so the clock is disabled twice and the kernel logs a warning on every teardown. The sources describe a warning flood, not a way for an attacker to gain access.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","i2c","linux-kernel","runtime","xiic"],"not_affected_if":["no-device-removal","xiic-driver-not-loaded"],"how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the xiic I2C driver is loaded with `lsmod | grep xiic`\n- Look for \"already disabled\" clock warnings in `dmesg`","fix":"- Linux kernel: the sources do not name a fixed kernel version","status":"open","published_at":"2026-11-03T12:17:31+00:00","first_seen_at":"2026-11-03T12:20:38+00:00","triaged_at":"2026-11-03T12:22:59+00:00","updated_at":"2026-11-03T12:22:59+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T12:22:59Z","model":"claude-haiku-5-5","output":{"fix":"- Linux kernel: the sources do not name a fixed kernel version","reach":"local","title":"Linux kernel I2C xiic driver: clock warning flood on teardown","impact":"low","summary":"A bug in the Linux kernel's xiic I2C controller driver tears down runtime power management in the wrong order on removal, so the clock is disabled twice and the kernel logs a warning on every teardown. The sources describe a warning flood, not a way for an attacker to gain access.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","embedded","i2c","xiic"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Kernel log flooded with clock warnings on device removal","analyst_note":"","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the xiic I2C driver is loaded with `lsmod | grep xiic`\n- Look for \"already disabled\" clock warnings in `dmesg`","plain_action":"","needs_analyst":false,"not_affected_if":["xiic-driver-not-loaded","no-device-removal"],"who_is_affected":"Systems running a Linux kernel with the xiic I2C controller driver, typically embedded boards that use Xilinx I2C hardware, where the driver is bound and the device is removed or unbound. The sources describe a kernel log warning on teardown and do not describe a security exposure. Systems without this driver can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000756,"input_tokens":4781,"output_tokens":556,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99248':13A,16A '/disable':107C 'access':75B 'across':371C,376C 'activ':113C,175C 'add':381C 'afterward':165C 'alreadi':213C,222C 'already-dis':212C 'also':407C 'arm':180C,300C 'attack':72B 'autosuspend':141C,178C,183C,297C,302C,410C 'balanc':261C 'bug':25B 'call':136C 'clear':181C,408C 'clk':96C,160C,195C,203C,207C,217C,318C 'clkn':221C 'clock':6A,48B,199C,215C,257C,321C 'control':33B 'convers':101C 'core':218C 'count':259C,274C,294C 'cve':11A,14A 'describ':63B 'devic':174C,316C 'devm':109C,159C,202C,324C,356C 'devm-regist':355C 'devr':100C,154C,364C 'disabl':50B,145C,196C,208C,214C,219C,223C,251C,270C,279C,310C,319C,327C 'dont':139C 'driver':5A,34B 'drop':116C,227C,276C,292C 'embed':17B 'enabl':106C,114C,152C,162C,205C,246C,258C,299C 'error':343C,398C,405C 'everi':59B,225C 'expir':313C 'explicit':394C 'fail':379C 'first':295C 'fix':95C 'flood':8A,66B,98C 'follow':81C,280C 'free':392C 'freed':361C 'futur':378C 'gain':74B 'get':161C,204C 'goto':352C 'hand':350C 'handler':358C 'helper':230C 'i.e':146C 'i2c':3A,18B,32B,86C,192C 'idl':187C 'immedi':189C 'instead':286C 'irq':337C,386C,390C 'kernel':2A,21B,29B,54B,79C 'later':201C,362C 'leav':172C 'let':311C 'lifo':156C 'linux':1A,20B,28B,78C 'linux-kernel':19B 'live':370C 'log':55B 'make':185C 'manag':39B,91C,125C,229C,236C,336C 'manual':103C,373C 'match':412C 'noidl':285C 'non':90C,235C,335C 'non-manag':89C,234C,334C 'order':43B,134C,262C 'path':344C,399C,406C 'pm':93C,104C,110C,122C,129C,137C,143C,149C,168C,238C,244C,268C,277C,282C,288C,308C,348C 'power':38B 'preemption':306C 'probe':249C,342C,397C,404C 'put':170C,284C,290C 'regist':357C 'releas':126C,163C,206C,325C 'remov':45B,119C,167C,254C,264C,402C,416C 'remove-tim':118C 'replac':102C 'request':338C,384C,388C 'resolv':85C 'restor':88C,232C,332C 'rpm':186C 'run':164C 'runtim':22B,37B,92C,105C,111C,121C,128C,138C,144C,148C,169C,193C,237C,243C,267C,278C,283C,289C,309C,347C 'set':112C 'setup':239C 'sourc':62B 'stay':260C,369C 'step':380C 'still':151C,298C 'suspend':188C,194C,314C 'sync':171C,291C 'tear':35B,127C 'teardown':10A,60B,123C,226C,241C,265C,374C,414C 'thread':389C 'time':120C 'timer':179C,303C 'twice':51B 'unprepar':209C 'unwind':346C,365C 'usag':273C 'use':140C,182C,409C 'via':351C 'vulner':82C 'warn':7A,57B,65B,97C,220C,331C 'way':69B 'well':340C 'would':368C 'wrong':42B,133C 'xiic':4A,23B,31B,87C,191C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the xiic I2C controller driver, typically embedded boards that use Xilinx I2C hardware, where the driver is bound and the device is removed or unbound. The sources describe a kernel log warning on teardown and do not describe a security exposure. Systems without this driver can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","i2c","linuxkernel","low","runtime","xiic"],"first_public_at":"2026-11-03T12:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99248","severity":null,"published_at":"2026-11-03T12:17:31+00:00","modified_at":"2026-11-03T12:17:31+00:00","first_seen_at":"2026-11-03T12:20:38+00:00","fetched_at":"2026-11-03T12:20:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}