CVE-2026-31627

Vulnerability

A missing bounds check in the Linux kernel's i2c: s3c24xx driver can lead to out-of-bounds memory access. The first byte of an I2C SMBus message specifies the block size, but the driver did not verify that this size falls within the valid range of 0..I2C_SMBUS_BLOCK_MAX before processing the message [1][4]. This oversight mirrors a previously fixed issue in the Tegra I2C driver addressed by commit a6e04f05ce0b [1].

Exploitation

Exploitation requires an attacker to control or influence an I2C SMBus block read transaction handled by the s3c24xx driver. No special privileges are needed beyond the ability to communicate with the driver, which could be achieved locally through a malicious userspace program or by a compromised I2C peripheral device [1]. The attack surface is local; the vulnerability is not remotely exploitable without prior access.

Impact

A successful exploit could allow an attacker to read or write memory outside the intended buffer, potentially leading to information disclosure or system instability. Given the CVSS v3 score of 7.8 (High), the impact is considered significant, though not directly leading to remote code execution without other primitives [1].

Mitigation

The fix has been applied to the Linux kernel stable branches. Users should update to a kernel version containing the commit fa00738ab30b or its backports [1][2][3][4]. No workaround is available; updating is the recommended course of action.