Executive brief
A vulnerability in the Linux kernel's I2C driver for Samsung S3C24XX processors could allow a local attacker to cause a system crash or potentially gain unauthorized access to data. The issue stems from the system failing to properly validate the size of incoming messages from hardware devices. This could lead to memory corruption or unstable system behavior in embedded devices or hardware using these specific processors.
Technical details
A vulnerability exists in the i2c-s3c2410 driver within the Linux kernel due to insufficient validation of SMBus message lengths. In the i2c_s3c_irq_nextbyte function, the driver processes the first byte of an SMBus block read as the message length without verifying it against the I2C_SMBUS_BLOCK_MAX limit. An attacker with local access could potentially exploit this to cause a buffer overflow or out-of-bounds memory access by providing a specially crafted message length. This issue has been resolved by adding bounds checking to ensure the length byte is between 1 and I2C_SMBUS_BLOCK_MAX, returning an EPROTO error if the check fails.
Affected products
- Linux Linux Kernel 3.10.1 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-06-01: patched
References
- https://git.kernel.org/stable/c/2d262da4bca6fab96e2e709feb95b31b0a9a03a7
- https://git.kernel.org/stable/c/377fae22a137b6b89f3f32399a58c52cf2325416
- https://git.kernel.org/stable/c/71b3c316b22c555d2769126a92b1244b15a9750d
- https://git.kernel.org/stable/c/8f756a5964396da0fc9e0db33253a5b85dbbcbb6
- https://git.kernel.org/stable/c/aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b
- https://git.kernel.org/stable/c/c0128c7157d639a931353ea344fb44aad6d6e17a
- https://git.kernel.org/stable/c/d87d5620125a03b1eadbd5df39748215d3db7ddb