| The vulnerability CVE-2020-36780 affects the Linux kernel's i2c sprd driver. Specifically, when `pm_runtime_get_sync` fails in the functions `sprd_i2c_master_xfer()` and `sprd_i2c_remove()`, it increments the PM reference count without decrementing it, leading to a reference leak. |
| |
| The issue arises because `pm_runtime_get_sync` increments the PM reference count even if it fails. In the affected functions, the code does not properly handle this scenario, resulting in an unbalanced usage counter. To fix this, the kernel developers replaced `pm_runtime_get_sync` with `pm_runtime_resume_and_get`, which keeps the usage counter balanced. |
| |
| The vulnerability was introduced in Linux kernel version 4.14 with commit 8b9ec0719834 and has been fixed in various subsequent versions, including 5.4.119, 5.10.37, 5.11.21, 5.12.4, and 5.13. The affected file is `drivers/i2c/busses/i2c-sprd.c`. To mitigate this issue, users are recommended to update to the latest stable kernel version. Individual changes can be found in the specified commits if updating to the latest release is not possible. |
| |
