Executive Summary

This vulnerability exists in the Linux kernel's hardware monitoring driver for the tps53679 chip. The function i2c_smbus_read_block_data() can return 0, indicating a zero-length read. However, the code did not properly handle this case and accessed an array element at buf[-1], which is out-of-bounds and reads memory before the buffer on the stack.

The fix involved changing the condition to treat a zero-length read as an error, preventing this out-of-bounds access.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to out-of-bounds memory access on the stack, which may cause undefined behavior such as crashes or potentially allow an attacker to read sensitive memory or execute arbitrary code depending on the context and exploitability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the issue has been fixed. The fix involves changing the check in the tps53679 driver to treat zero-length reads as errors, preventing out-of-bounds array access.

Applying the latest kernel patches or upgrading to a kernel version released after 2026-05-01 that includes this fix is recommended.

Useful 0 Not Useful 0