CVE-2026-43380

Vulnerability

The q54sj108a2_debugfs_read function in the Linux kernel's hwmon subsystem contains a stack buffer overflow caused by incorrect usage of the bin2hex() function. The function passes arguments in the wrong order, writing hex output to a buffer (data) that is only 34 bytes, while bin2hex() produces 64 bytes for a 32-byte input. This results in overwriting 30 bytes beyond the buffer on the stack. Additionally, the source buffer was zero-initialized, causing all-zero output regardless of actual I2C data [1].

Exploitation

Exploitation requires the ability to read a debugfs file exposed by the q54sj108a2 driver. Since debugfs is typically accessible only to users with root privileges or those in the appropriate group, the attacker needs local access and sufficient permissions. The overflow occurs during a read operation, which could corrupt adjacent stack memory, potentially leading to control-flow hijacking or privilege escalation.

Impact

An attacker who can perform the debugfs read may cause a kernel stack buffer overflow. This could lead to arbitrary code execution in kernel context, system crash (denial of service), or information disclosure. The severity is high due to the potential for privilege escalation.

Mitigation

The fix expands the destination buffer to 66 bytes, corrects the argument order, and uses the actual read count. It was committed to the Linux kernel stable tree [1]. Users should apply the patch or update to a kernel version containing the fix.