CVE-2026-98204

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() When chunking writes into SMBus blocks in rmi_smb_write_block(), the loop calculates block_len using the original total length (len) instead of the remaining length (cur_len). If len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32 for every iteration, even on the final partial chunk where fewer than 32 bytes remain. This causes smb_block_write() to read 32 bytes from the advanced data buffer pointer, reading past the end of the input buffer. Fix this by calculating block_len using cur_len and advancing the buffer and address pointers by block_len.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98204

EUVD

EUVD-2026-93132

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	82264d0cf7aef2247563c031ff2ab96579d5d0cc
Linux	Linux	82264d0cf7aef2247563c031ff2ab96579d5d0cc
Linux	Linux	82264d0cf7aef2247563c031ff2ab96579d5d0cc
Linux	Linux	82264d0cf7aef2247563c031ff2ab96579d5d0cc
Linux	Linux	82264d0cf7aef2247563c031ff2ab96579d5d0cc
Linux	Linux	82264d0cf7aef2247563c031ff2ab96579d5d0cc
Linux	Linux	82264d0cf7aef2247563c031ff2ab96579d5d0cc
Linux	Linux	82264d0cf7aef2247563c031ff2ab96579d5d0cc
Linux	Linux	4.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel where a function called rmi_smb_write_block() incorrectly calculates the length of data chunks when writing to an SMBus. It uses the total data length instead of the remaining data length, causing it to read past the end of the input buffer when handling data larger than 32 bytes.

Detection Guidance

This vulnerability is specific to the Linux kernel's RMI SMBus driver and requires kernel-level inspection. Check if your system uses the affected driver by examining kernel logs for rmi_smb_write_block errors or out-of-bounds warnings. Use commands like dmesg | grep rmi_smb or journalctl -k | grep rmi_smb to detect anomalies.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory data beyond the intended buffer, potentially exposing confidential information or causing system instability. It primarily affects systems using the Linux kernel with RMI SMBus functionality.

Compliance Impact

This vulnerability involves an out-of-bounds read in the Linux kernel's rmi_smb_write_block function, which could lead to memory corruption or information disclosure. Such flaws may violate data integrity and confidentiality requirements under standards like GDPR and HIPAA, potentially exposing sensitive data.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve the out-of-bounds read issue in rmi_smb_write_block. If immediate patching is not possible, disable the RMI SMBus driver if not required by your system. Monitor kernel updates from your distribution for fixes.

Hi! I’m here to help you understand CVE-2026-98204. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70