CVE-2026-64236 i2c: davinci: fix division by zero on missing clock-frequency
A missing clock-frequency property in the device tree causes a division-by-zero kernel panic in the i2c davinci driver, leading to system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64236?
CVE-2026-64236 is a medium-severity denial of service vulnerability in Linux kernel, published on 24 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
i2c: davinci: fix division by zero on missing clock-frequency
When the 'clock-frequency' property is missing from the device tree, the driver falls back to DAVINCI_I2C_DEFAULT_BUS_FREQ. However, this macro was defined in kHz (100), whereas the device tree property is expected in Hz.
The probe function divided the fallback value by 1000, causing integer truncation that resulted in dev->bus_freq = 0. This triggered a deterministic division-by-zero kernel panic when calculating clock dividers later in the probe sequence.
Fix this by redefining DAVINCI_I2C_DEFAULT_BUS_FREQ in Hz (100000) to match the expected device tree property unit, allowing the existing division logic to work correctly for both cases.
Weakness: CWE-369
Which versions are affected by CVE-2026-64236?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64236?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-64236 being exploited?
There is no known exploitation of CVE-2026-64236 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64236, DEBIAN-CVE-2026-64236, GHSA-hmfg-g42r-7r36, ROOT-OS-UBUNTU-2204-CVE-2026-64236, UBUNTU-CVE-2026-64236.