CVE-2026-52948— I2C 设备驱动 I2C_TIMEOUT ioctl 整数溢出漏洞
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2026-52948 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl While fuzzing with Syzkaller, a persistent `schedule_timeout: wrong timeout value` warning was observed, accompanied by SMBus controller state machine corruption. The I2C_TIMEOUT ioctl accepts a user-provided timeout in multiples of 10 ms. The user argument is checked against INT_MAX, but it is subsequently multiplied by 10 before being passed to msecs_to_jiffies(). A malicious user can pass a large value (e.g., 429496729) that passes the `arg > INT_MAX` check but overflows when multiplied by 10. This results in a truncated 32-bit unsigned value that bypasses the internal `(int)m < 0` check in `msecs_to_jiffies()`. The truncated value is then assigned to `client->adapter->timeout` (a signed 32-bit int), which is reinterpreted as a negative number. When passed to wait_for_completion_timeout(), this negative value undergoes sign extension to a 64-bit unsigned long, triggering the `schedule_timeout` warning and causing premature returns. This leaves the SMBus state machine in an unrecoverable state, constituting a local Denial of Service (DoS). Fix this by bounding the user argument to `INT_MAX / 10`. [wsa: move the comment as well]
来源: 美国国家漏洞数据库 NVD
CVSS Information
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
N/A
来源: 美国国家漏洞数据库 NVD
受影响产品
二、漏洞 CVE-2026-52948 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-52948 的情报信息
请登录查看更多情报信息。
CVE-2026-52948 补丁与修复 (3)
CVE-2026-52948 其他参考 (5)
同批安全公告 · Linux · 2026-06-24 · 共 219 条
| CVE-2026-52979 | net: psp: 创建关联时检查设备注销 | |
| CVE-2026-52992 | adfs_validate_bblk() 未验证 nzones 漏洞 | |
| CVE-2026-52993 | TIPC tipc_buf_append() 双重释放漏洞 | |
| CVE-2026-52991 | sched/psi 文件释放与压力写入间竞态条件漏洞 | |
| CVE-2026-52990 | fsnotify inode引用泄漏漏洞 | |
| CVE-2026-52988 | netfilter: nf_tables 在提交阶段使用 splice_list_rcu() 加入钩子列表 | |
| CVE-2026-52989 | nvmet-tcp 传播 nvmet_tcp_build_pdu_iovec() 错误到调用者 | |
| CVE-2026-52987 | AMD GPU 驱动用户队列验证中双重释放漏洞 | |
| CVE-2026-52986 | netfilter nf_conntrack_sip 漏洞 | |
| CVE-2026-52985 | netdevsim 虚拟网卡 iphdr结构体未初始化漏洞 | |
| CVE-2026-52984 | Linux netem 队列限制检查漏洞 | |
| CVE-2026-52982 | Realtek RTL8150 网卡 use-after-free 漏洞 | |
| CVE-2026-52983 | Airoha网络驱动TX路径BQL失衡漏洞 | |
| CVE-2026-52981 | 内核neigh模块skb所有权管理漏洞 | |
| CVE-2026-52969 | KVM: kvm_reset_dirty_gfn() 回绕偏移拒绝漏洞 | |
| CVE-2026-52971 | ena: get_timestamp中潜在Use-after-Free漏洞 | |
| CVE-2026-52972 | crypto: af_alg - AEAD附加数据长度限制漏洞 | |
| CVE-2026-52970 | nft_ct: obj eval缺失expect put导致漏洞 | |
| CVE-2026-52973 | futex: 移除私有默认哈希分配中CLONE_THREAD要求 | |
| CVE-2026-52968 | KVM s390 PCI GAIT表索引双重缩放指针算法定位漏洞 |
显示前 20 条，共 219 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-52948
暂无评论