CVE-2026-64191

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

i2c: stub: Reject I2C block transfers with invalid length

The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]

as the transfer length. The existing check only clamps it to avoid

overrunning the chip->words[256] register array, but does not validate

it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union

i2c_smbus_data.block buffer (34 bytes total). The driver is a

development/test tool (CONFIG_I2C_STUB=m, not built by default)

that must be loaded with a chip_addr= parameter.

A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl

with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing

stub_xfer() to read or write past the end of the union

i2c_smbus_data.block buffer:

BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)

Read of size 1 at addr ffff88800abcfd92 by task exploit/81

Call Trace:

<TASK>

stub_xfer (drivers/i2c/i2c-stub.c:223)

__i2

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References