PT-2026-61644 · Linux · Linux
CVE-2026-64191
·
Publicado
2026-07-20
·
Atualizado
2026-07-20
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
i2c: stub: Reject I2C block transfers with invalid length
The I2C SMBUS I2C BLOCK DATA case in stub xfer() uses data->block[0]
as the transfer length. The existing check only clamps it to avoid
overrunning the chip->words[256] register array, but does not validate
it against I2C SMBUS BLOCK MAX (32), which is the limit of the union
i2c smbus data.block buffer (34 bytes total). The driver is a
development/test tool (CONFIG I2C STUB=m, not built by default)
that must be loaded with a chip addr= parameter.
A local user with access to /dev/i2c-* can issue an I2C SMBUS ioctl
with I2C SMBUS I2C BLOCK DATA and data->block[0] > 32, causing
stub xfer() to read or write past the end of the union
i2c smbus data.block buffer:
BUG: KASAN: stack-out-of-bounds in stub xfer (drivers/i2c/i2c-stub.c:223)
Read of size 1 at addr ffff88800abcfd92 by task exploit/81
Call Trace:
stub xfer (drivers/i2c/i2c-stub.c:223)
i2c smbus xfer (drivers/i2c/i2c-core-smbus.c:593)
i2c smbus xfer (drivers/i2c/i2c-core-smbus.c:536)
i2cdev ioctl smbus (drivers/i2c/i2c-dev.c:391)
i2cdev ioctl (drivers/i2c/i2c-dev.c:478)
x64 sys ioctl (fs/ioctl.c:583)
do syscall 64 (arch/x86/entry/syscall 64.c:94)
entry SYSCALL 64 after hwframe (arch/x86/entry/entry 64.S:130)
The bug exists because i2c-stub implements .smbus xfer directly,
bypassing the I2C SMBUS BLOCK MAX validation in
i2c smbus xfer emulated(). The I2C SMBUS BLOCK DATA case in the same
function correctly validates against I2C SMBUS BLOCK MAX, but the
I2C SMBUS I2C BLOCK DATA case does not.
Fix by rejecting transfers with data->block[0] == 0 or
data->block[0] > I2C SMBUS BLOCK MAX with -EINVAL, consistent with
both the I2C SMBUS BLOCK DATA case in the same function and the
I2C SMBUS I2C BLOCK DATA validation in i2c smbus xfer emulated().
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux