CVE-2026-80931

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

w1: ds28e17: reject an oversize length on an I2C block read

w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire

to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the

device. The downstream slave puts a length byte in buf[0]. The driver

then reads that many bytes into buf[1] with w1_f19_i2c_read().

buf[0] is controlled by the device and can be 0 to 255.

w1_f19_i2c_read() only rejects a zero count. The caller buffer is

I2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read

run past it, up to about 222 bytes out of bounds.

The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That

check runs after master_xfer returns. By then the write is already

done. i2c-algo-bit rejects an oversize length before it copies, and

returns -EPROTO.

Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the

same way i2c-algo-bit does.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References