CVE-2026-98204
Received
Received - Intake
Out-of-Bounds Read in Linux Kernel rmi_smbus
Vulnerability report for CVE-2026-98204, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-06
Last updated on: 2026-10-06
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
When chunking writes into SMBus blocks in rmi_smb_write_block(), the
loop calculates block_len using the original total length (len) instead
of the remaining length (cur_len).
If len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32
for every iteration, even on the final partial chunk where fewer than 32
bytes remain. This causes smb_block_write() to read 32 bytes from the
advanced data buffer pointer, reading past the end of the input buffer.
Fix this by calculating block_len using cur_len and advancing the buffer
and address pointers by block_len.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 82264d0cf7aef2247563c031ff2ab96579d5d0cc |
| Linux | Linux | 82264d0cf7aef2247563c031ff2ab96579d5d0cc |
| Linux | Linux | 82264d0cf7aef2247563c031ff2ab96579d5d0cc |
| Linux | Linux | 82264d0cf7aef2247563c031ff2ab96579d5d0cc |
| Linux | Linux | 82264d0cf7aef2247563c031ff2ab96579d5d0cc |
| Linux | Linux | 82264d0cf7aef2247563c031ff2ab96579d5d0cc |
| Linux | Linux | 82264d0cf7aef2247563c031ff2ab96579d5d0cc |
| Linux | Linux | 82264d0cf7aef2247563c031ff2ab96579d5d0cc |
| Linux | Linux | 4.10 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
