CVE-2026-98204

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()

When chunking writes into SMBus blocks in rmi_smb_write_block(), the

loop calculates block_len using the original total length (len) instead

of the remaining length (cur_len).

If len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32

for every iteration, even on the final partial chunk where fewer than 32

bytes remain. This causes smb_block_write() to read 32 bytes from the

advanced data buffer pointer, reading past the end of the input buffer.

Fix this by calculating block_len using cur_len and advancing the buffer

and address pointers by block_len.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References