Executive brief
A vulnerability exists in a specific Linux kernel testing tool used for simulating I2C hardware devices. A local user with access to I2C device files could trigger a system crash or potentially corrupt memory by sending malformed data requests. This component is typically used for development and is not enabled by default in most production environments.
Technical details
A stack-based out-of-bounds vulnerability exists in the i2c-stub driver (drivers/i2c/i2c-stub.c) within the stub_xfer() function. The root cause is a failure to validate the transfer length (data->block[0]) against I2C_SMBUS_BLOCK_MAX (32) during I2C_SMBUS_I2C_BLOCK_DATA operations. A local attacker with access to /dev/i2c-* can issue an I2C_SMBUS ioctl with an invalid length, causing the kernel to read or write past the end of the i2c_smbus_data.block buffer. This can result in a kernel panic (DoS) or memory corruption. The issue has been patched by enforcing length checks and rejecting transfers with a length of zero or greater than 32.
Affected products
- Linux Linux Kernel 4710317891e4824ce1510a6b5066abbd3e917750
Timeline
- 2026-04-15: other: Patch authored
- 2026-07-20: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0526931b16e5a118d367b7bfce7d797e63f7ac69
- https://git.kernel.org/stable/c/1c4ffe6b4f04365485ed58d64c9bb86b46fc9037
- https://git.kernel.org/stable/c/21e87f336ac6303fed54a69b1d0d79a23b25c8d0
- https://git.kernel.org/stable/c/3fd225f3e4cd67ec8ddab1afed9da03c7c43537c
- https://git.kernel.org/stable/c/4bd8635f28c135a08aac6badcd7d9b5cdb34335f
- https://git.kernel.org/stable/c/5f4d2bd028ebb6e4c09a9d64842546022321d4a7
- https://git.kernel.org/stable/c/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e