Executive brief
A vulnerability was identified in the Linux kernel's 1-Wire thermal sensor driver that could lead to a buffer overflow. This component is responsible for managing communication with digital thermometers used in various industrial and embedded systems. An exploit could potentially allow a local user to crash the system or execute unauthorized code, impacting the reliability and security of devices like Siemens SIMATIC industrial controllers.
Technical details
An off-by-one buffer overflow exists in the 'alarms_store' function within 'drivers/w1/slaves/w1_therm.c'. The vulnerability is caused by the use of 'strcpy()' to copy a sysfs buffer into a destination allocated with 'size' bytes, failing to account for the NUL terminator appended at 'size + 1'. A local attacker with permissions to write to the 'alarms' sysfs attribute can trigger this overflow. The fix replaces the manual allocation and string copying with direct parsing using 'simple_strtoll()'. The issue affects Linux kernel versions starting from 5.8 and has been backported to various stable branches.
Affected products
- Linux Linux Kernel 5.8 to 6.13.x
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and later
Timeline
- 2025-12-16: disclosed: Initial patch submission
- 2026-02-04: advisory: CVE published
- 2026-02-06: patched: Patch committed to stable branches
References
- https://git.kernel.org/stable/c/060b08d72a38b158a7f850d4b83c17c2969e0f6b
- https://git.kernel.org/stable/c/49ff9b4b9deacbefa6654a0a2bcaf910c9de7e95
- https://git.kernel.org/stable/c/6a5820ecfa5a76c3d3e154802c8c15f391ef442e
- https://git.kernel.org/stable/c/6fd6d2a8e41b7f544a4d26cbd60bedf9c67893a0
- https://git.kernel.org/stable/c/761fcf46a1bd797bd32d23f3ea0141ffd437668a
- https://git.kernel.org/stable/c/b3fc3e1f04dcc7c41787bbf08a6e0d2728e022cf
- https://git.kernel.org/stable/c/e6b2609af21b5cccc9559339591b8a2cbf884169