Executive brief
A vulnerability in the Linux kernel's support for certain Realtek networking hardware could allow a local user to cause permanent hardware damage. Specifically, when the system attempts a zero-length data transfer, it may accidentally overwrite critical configuration data on connected components like SFP fiber optic modules. This can 'brick' the hardware, rendering it unusable and requiring physical replacement.
Technical details
An integer underflow vulnerability exists in the rtl9300 I2C controller driver within the Linux kernel. The 'rtl9300_i2c_config_xfer' function fails to validate the transfer length, which the hardware expects to be between 1 and 16 bytes. When a zero-length transfer (such as an SMBus Quick Operation) is requested, the calculation '(len - 1) & 0xf' results in an underflow, causing the controller to perform a 16-byte write instead of a 0-byte operation. This can lead to destructive writes on attached I2C devices, such as overwriting the EEPROM of SFP modules. The issue is resolved by adding explicit length checks and an I2C quirk to disallow zero-length transfers.
Affected products
- Linux Linux Kernel 6.13 to 6.16.7
Timeline
- 2025-10-01: advisory: Initial disclosure of CVE-2025-39928
- 2025-09-19: patched: Fix committed to stable kernel tree