CVE-2026-52948

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl

While fuzzing with Syzkaller, a persistent `schedule_timeout: wrong

timeout value` warning was observed, accompanied by SMBus controller

state machine corruption.

The I2C_TIMEOUT ioctl accepts a user-provided timeout in multiples of

10 ms. The user argument is checked against INT_MAX, but it is

subsequently multiplied by 10 before being passed to msecs_to_jiffies().

A malicious user can pass a large value (e.g., 429496729) that passes

the `arg > INT_MAX` check but overflows when multiplied by 10. This

results in a truncated 32-bit unsigned value that bypasses the

internal `(int)m < 0` check in `msecs_to_jiffies()`.

The truncated value is then assigned to `client->adapter->timeout`

(a signed 32-bit int), which is reinterpreted as a negative number.

When passed to wait_for_completion_timeout(), this negative value

undergoes sign extension to a 64-bit unsigned l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References