CVE-2026-46001

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()

Fix two bugs in pt5161l_read_block_data():

1. Buffer overrun: The local buffer rbuf is declared as u8 rbuf[24],

but i2c_smbus_read_block_data() can return up to

I2C_SMBUS_BLOCK_MAX (32) bytes. The i2c-core copies the data into

the caller's buffer before the return value can be checked, so

the post-read length validation does not prevent a stack overrun

if a device returns more than 24 bytes. Resize the buffer to

I2C_SMBUS_BLOCK_MAX.

2. Unexpected positive return on length mismatch: When all three

retries are exhausted because the device returns data with an

unexpected length, i2c_smbus_read_block_data() returns a positive

byte count. The function returns this directly, and callers treat

any non-negative return as success, processing stale or incomplete

buffer contents. Return -EIO when retries are exhausted with a

positive re

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References