{
  "threat_severity" : "Important",
  "public_date" : "2026-07-20T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: i2c: stub: Reject I2C block transfers with invalid length",
    "id" : "2502872",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2502872"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-787",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\ni2c: stub: Reject I2C block transfers with invalid length\nThe I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]\nas the transfer length. The existing check only clamps it to avoid\noverrunning the chip->words[256] register array, but does not validate\nit against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union\ni2c_smbus_data.block buffer (34 bytes total). The driver is a\ndevelopment/test tool (CONFIG_I2C_STUB=m, not built by default)\nthat must be loaded with a chip_addr= parameter.\nA local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl\nwith I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing\nstub_xfer() to read or write past the end of the union\ni2c_smbus_data.block buffer:\nBUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)\nRead of size 1 at addr ffff88800abcfd92 by task exploit/81\nCall Trace:\n<TASK>\nstub_xfer (drivers/i2c/i2c-stub.c:223)\n__i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)\ni2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)\ni2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)\ni2cdev_ioctl (drivers/i2c/i2c-dev.c:478)\n__x64_sys_ioctl (fs/ioctl.c:583)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:94)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n</TASK>\nThe bug exists because i2c-stub implements .smbus_xfer directly,\nbypassing the I2C_SMBUS_BLOCK_MAX validation in\ni2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same\nfunction correctly validates against I2C_SMBUS_BLOCK_MAX, but the\nI2C_SMBUS_I2C_BLOCK_DATA case does not.\nFix by rejecting transfers with data->block[0] == 0 or\ndata->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with\nboth the I2C_SMBUS_BLOCK_DATA case in the same function and the\nI2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().", "A flaw was found in the Linux kernel's `i2c-stub` driver. A local user with access to the `/dev/i2c-*` device can exploit this vulnerability by issuing an I2C System Management Bus (SMBus) input/output control (ioctl) command with a specially crafted block transfer length. This invalid length can cause the driver to read or write beyond the allocated buffer, leading to a stack-out-of-bounds error and a system crash, resulting in a Denial of Service (DoS)." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:59737",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:59821",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.158.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:59723",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.42.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:59723",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.42.1.el9_8"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-64191\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64191\nhttps://lore.kernel.org/linux-cve-announce/2026072052-CVE-2026-64191-42fe@gregkh/T" ],
  "name" : "CVE-2026-64191",
  "csaw" : false
}