CVE-2026-43005

Vulnerability

In the Linux kernel's hwmon subsystem, the tps53679 driver contains an out-of-bounds array access vulnerability in the tps53679_identify_chip() function. The function calls i2c_smbus_read_block_data(), which can return 0 to indicate a zero-length read. When this happens, the code accesses buf[ret - 1], which becomes buf[-1], reading one byte before the stack-allocated buffer [1].

Exploitation

An attacker who can control the I2C bus response (e.g., through a malicious peripheral or by manipulating the hardware) can trigger a zero-length block read. No special privileges are required beyond the ability to interact with the I2C device. The out-of-bounds read occurs on the kernel stack, potentially leaking sensitive data or causing a crash.

Impact

Successful exploitation could lead to information disclosure (reading kernel stack memory) or a denial of service (system crash). The CVSS v3 score is 7.1 (High), reflecting the potential for significant impact with low attack complexity.

Mitigation

The fix changes the error check from ret < 0 to ret <= 0, treating a zero-length read as an error (-EIO), which prevents the out-of-bounds access. The patch has been applied to the stable kernel tree [1][2][3]. Users should update to a kernel version containing this fix.