Executive brief
A vulnerability was identified in the Linux kernel driver for the Astera Labs PT5161L retimer, a hardware component used for signal integrity in high-speed data paths. The driver contained a flaw that could allow a malfunctioning or malicious hardware device to cause a system crash or memory corruption by sending more data than the driver expected. This could lead to system instability or potentially allow an attacker with local access to escalate privileges.
Technical details
The vulnerability exists in pt5161l_read_block_data() within drivers/hwmon/pt5161l.c. First, a stack-based buffer 'rbuf' was fixed at 24 bytes, while the underlying i2c_smbus_read_block_data() function can return up to 32 bytes (I2C_SMBUS_BLOCK_MAX), leading to a buffer overrun before length validation occurs. Second, the function incorrectly returned a positive byte count even when retries were exhausted due to length mismatches, causing callers to process uninitialized or stale memory. An attacker with the ability to influence I2C traffic or a compromised device could exploit this to corrupt kernel memory. The fix resizes the buffer and ensures an -EIO error code is returned on failure.
Affected products
- Linux Linux Kernel Introduced in 1b2ca93cd0592 (v6.3) and fixed in various stable branches
Timeline
- 2026-04-10: patched: Initial fix committed to mainline kernel
- 2026-05-27: advisory: CVE-2026-46001 published