CVE-2026-93287

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

i2c: smbus: reject oversized block transfers in the common path

The SMBus block transfer length data->block[0] is validated in

i2c_smbus_xfer_emulated() but that check runs too late for tracepoints

and is skipped entirely when the adapter provides a native smbus_xfer

implementation. This allows user-controlled oversized block lengths to

reach tracepoint memcpy calls and driver callbacks unchecked.

Add an early validation in __i2c_smbus_xfer() that rejects block

transfers whose caller-supplied length is zero or exceeds

I2C_SMBUS_BLOCK_MAX before any tracepoint fires or driver callback

runs. data->block[0] is filled in by the device on SMBus block reads,

so the check is scoped to operations where the length is actually

supplied by the caller. This is consistent with the existing -EINVAL

convention in the emulated path and protects all downstream consumers

at once: the smbus_write tracepoint, all native smbus_xfer driv

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References