CVE-2026-14986

Received Received - Intake

Buffer Overflow in ITE IT51xxx I2C Driver

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Zephyr Project

Description

The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size data->target_in_buffer inside its target FIFO interrupt handler target_i2c_isr_fifo() in drivers/i2c/i2c_ite_it51xxx.c. The copy loop stores to target_in_buffer[i + data->w_index] and only checks data->w_index against sizeof(data->target_in_buffer) after the write has already completed, so the bounds check cannot prevent the overflow. The running index data->w_index accumulates count bytes on every FIFO-fill interrupt of an ongoing transaction and is reset to zero only on a STOP or timeout condition. An I2C host that streams a single write transaction longer than the buffer (default CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE = 256 bytes) drives data->w_index past the end of the buffer, and each subsequent host byte is written out of bounds into the adjacent data->target_out_buffer and following static device data. The trigger is a malicious or misbehaving I2C master on the same bus (for example a compromised application processor or a rogue device on an exposed I2C bus); no software privilege on the victim is required and the handler runs in the target's kernel/firmware context. Because both the written values and the overflow length are attacker-controlled, this is an out-of-bounds write that can crash the controller or be shaped toward code execution. The fix adds a pre-write bounds check in target_i2c_fifo_read_to_buf() that aborts and resets the FIFO before any out-of-bounds store.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-14986

Affected Vendors & Products

Vendor	Product	Version / Range
ite	it51xxx	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a buffer overflow vulnerability in the ITE it51xxx I2C driver when operating as an I2C target in buffer mode. The driver copies host-supplied write data into a fixed-size buffer without proper bounds checking during the copy operation. The index tracking the write position is only checked after the write completes, allowing an overflow if the host sends more data than the buffer can hold. This can lead to memory corruption, crashes, or potential code execution.

Detection Guidance

This vulnerability is specific to the ITE it51xxx I2C driver in buffer mode and requires direct access to the I2C bus. Detection involves checking if the affected driver is loaded and monitoring for unusual I2C traffic patterns. Use commands like 'lsmod | grep ite_it51xxx' to verify if the driver is loaded. Monitor kernel logs for I2C-related errors or crashes with 'dmesg | grep i2c'.

Impact Analysis

If you use a system with the vulnerable ITE it51xxx I2C driver, a malicious or misbehaving I2C master on the same bus could exploit this to crash the system or execute arbitrary code. The attack requires physical or logical access to the I2C bus and does not need any software privileges on the target device. Systems with exposed I2C buses are particularly at risk.

Mitigation Strategies

Immediately disable the ITE it51xxx I2C target buffer mode by disabling CONFIG_I2C_TARGET_BUFFER_MODE in the kernel configuration. Update the driver to the patched version that includes bounds checking in target_i2c_fifo_read_to_buf(). Isolate the I2C bus if possible to prevent malicious access.

Hi! I’m here to help you understand CVE-2026-14986. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70