Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64191— i2c: stub: Reject I2C block transfers with invalid length

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 2.6.33版本存在缓冲区溢出漏洞，该漏洞源于i2c: stub驱动在处理I2C_SMBUS_I2C_BLOCK_DATA传输时，未对data->block[0]进行有效长度验证，可能导致本地用户通过I2C_SMBUS ioctl进行越界读取或写入，造成栈缓冲区溢出。

CVSS 7.8 · High EPSS 0.13% · P2

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 4710317891e4824ce1510a6b5066abbd3e917750< 7e9072dbd5f2f17934751873450d2c22080ead80 affected
4710317891e4824ce1510a6b5066abbd3e917750< 21e87f336ac6303fed54a69b1d0d79a23b25c8d0 affected
4710317891e4824ce1510a6b5066abbd3e917750< 3fd225f3e4cd67ec8ddab1afed9da03c7c43537c affected
4710317891e4824ce1510a6b5066abbd3e917750< 1c4ffe6b4f04365485ed58d64c9bb86b46fc9037 affected
4710317891e4824ce1510a6b5066abbd3e917750< 4bd8635f28c135a08aac6badcd7d9b5cdb34335f affected
4710317891e4824ce1510a6b5066abbd3e917750< 5f4d2bd028ebb6e4c09a9d64842546022321d4a7 affected
4710317891e4824ce1510a6b5066abbd3e917750< 0526931b16e5a118d367b7bfce7d797e63f7ac69 affected
4710317891e4824ce1510a6b5066abbd3e917750< 6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64191

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
i2c: stub: Reject I2C block transfers with invalid length
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avoid overrunning the chip->words[256] register array, but does not validate it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union i2c_smbus_data.block buffer (34 bytes total). The driver is a development/test tool (CONFIG_I2C_STUB=m, not built by default) that must be loaded with a chip_addr= parameter. A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing stub_xfer() to read or write past the end of the union i2c_smbus_data.block buffer: BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223) Read of size 1 at addr ffff88800abcfd92 by task exploit/81 Call Trace: <TASK> stub_xfer (drivers/i2c/i2c-stub.c:223) __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593) i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536) i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391) i2cdev_ioctl (drivers/i2c/i2c-dev.c:478) __x64_sys_ioctl (fs/ioctl.c:583) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> The bug exists because i2c-stub implements .smbus_xfer directly, bypassing the I2C_SMBUS_BLOCK_MAX validation in i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same function correctly validates against I2C_SMBUS_BLOCK_MAX, but the I2C_SMBUS_I2C_BLOCK_DATA case does not. Fix by rejecting transfers with data->block[0] == 0 or data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with both the I2C_SMBUS_BLOCK_DATA case in the same function and the I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 2.6.33版本存在缓冲区溢出漏洞，该漏洞源于i2c: stub驱动在处理I2C_SMBUS_I2C_BLOCK_DATA传输时，未对data->block[0]进行有效长度验证，可能导致本地用户通过I2C_SMBUS ioctl进行越界读取或写入，造成栈缓冲区溢出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 4710317891e4824ce1510a6b5066abbd3e917750 ~ 7e9072dbd5f2f17934751873450d2c22080ead80 -
Linux Linux 2.6.33 -

II. Public POCs for CVE-2026-64191

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64191

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64191 (6)

Same Patch Batch · Linux · 2026-07-20 · 9 CVEs total

CVE-2026-64206 8.8 HIGH Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
CVE-2026-64188 7.8 HIGH net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
CVE-2026-64189 7.8 HIGH netfilter: ipset: fix race between dump and ip_set_list resize
CVE-2026-64187 xfs: fail recovery on a committed log item with no regions
CVE-2026-64190 net: team: fix NULL pointer dereference in team_xmit during mode change
CVE-2026-64192 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
CVE-2026-64205 i2c: i801: fix hardware state machine corruption in error path
CVE-2026-64207 net/sched: dualpi2: fix GSO backlog accounting

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64191

No comments yet

Leave a comment