CVE-2026-64191
Received Received - Intake

Buffer Overflow in Linux Kernel I2C Stub Driver

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avoid overrunning the chip->words[256] register array, but does not validate it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union i2c_smbus_data.block buffer (34 bytes total). The driver is a development/test tool (CONFIG_I2C_STUB=m, not built by default) that must be loaded with a chip_addr= parameter. A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing stub_xfer() to read or write past the end of the union i2c_smbus_data.block buffer: BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223) Read of size 1 at addr ffff88800abcfd92 by task exploit/81 Call Trace: <TASK> stub_xfer (drivers/i2c/i2c-stub.c:223) __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593) i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536) i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391) i2cdev_ioctl (drivers/i2c/i2c-dev.c:478) __x64_sys_ioctl (fs/ioctl.c:583) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> The bug exists because i2c-stub implements .smbus_xfer directly, bypassing the I2C_SMBUS_BLOCK_MAX validation in i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same function correctly validates against I2C_SMBUS_BLOCK_MAX, but the I2C_SMBUS_I2C_BLOCK_DATA case does not. Fix by rejecting transfers with data->block[0] == 0 or data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with both the I2C_SMBUS_BLOCK_DATA case in the same function and the I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-64191
EUVD
EUVD-2026-46011

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's I2C stub driver, which is a development and testing tool. The issue occurs when handling I2C block transfers with invalid lengths. The driver fails to validate the transfer length against the maximum allowed size (32 bytes), leading to potential out-of-bounds memory access. This can cause stack corruption and crashes when a local user with access to /dev/i2c-* devices sends malicious I2C_SMBUS ioctl commands.

Detection Guidance

This vulnerability affects the Linux kernel's I2C stub driver, which is not built by default. Detection requires local access to a system with the vulnerable driver loaded. Check if the i2c-stub module is loaded using 'lsmod | grep i2c_stub'. If loaded, verify if the driver is exposed via /dev/i2c-* devices.

Impact Analysis

If you have access to /dev/i2c-* devices on a system with the vulnerable Linux kernel, an attacker could exploit this flaw to cause a system crash or execute arbitrary code with kernel privileges. Since the I2C stub driver is not built by default, the risk is limited to systems explicitly configured with this driver loaded.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a local privilege escalation issue in a Linux kernel test driver (i2c-stub) that could allow unauthorized memory access. Compliance impacts would only occur if this vulnerability were exploited to access sensitive data, which is not its primary function.

Mitigation Strategies

Immediately unload the i2c-stub module using 'sudo rmmod i2c-stub'. If the module is not in use, prevent it from loading by blacklisting it in /etc/modprobe.d/. Update your Linux kernel to a patched version that includes the fix for this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64191. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart