{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31627","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-03-09T15:48:24.124Z","datePublished":"2026-04-24T14:42:48.342Z","dateUpdated":"2026-08-05T12:23:54.379Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:23:54.379Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: s3c24xx: check the size of the SMBUS message before using it\n\nThe first byte of an i2c SMBUS message is the size, and it should be\nverified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX\nbefore processing it.\n\nThis is the same logic that was added in commit a6e04f05ce0b (\"i2c:\ntegra: check msg length in SMBUS block read\") to the i2c tegra driver."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reachable from local userspace through `/dev/i2c-*` ioctls (`I2C_SMBUS` or `I2C_RDWR`) into the s3c24xx adapter transfer routine. The malformed length byte is supplied by the selected I2C/SMBus slave during that local transaction.\nAC:L - Once an attacker can issue a block read to an attacker-controlled or malicious SMBus slave, returning a zero or greater-than-32 first byte deterministically reaches the bug. There is no race or condition outside the attacker's control in the vulnerable length handling.\nPR:L - The kernel path has no capability check; the attacker only needs local access to the relevant i2c-dev character device, commonly granted via device permissions or an i2c-like group. This is not a real init-namespace root requirement.\nUI:N - No victim action is needed after the attacker has access to the bus interface and target slave response. The attacker can initiate the SMBus block read directly.\nS:U - The corruption occurs in kernel memory within the same kernel security authority. It does not cross a hypervisor, IOMMU, or other separate security scope boundary.\nC:H - An oversized device-supplied SMBus length makes the driver read and store beyond the allocated SMBus buffer, and raw i2c-dev paths can also copy back using the inflated length. This can disclose adjacent kernel memory.\nI:H - The slave controls bytes written past the end of the kernel SMBus buffer, creating an out-of-bounds kernel memory write. Such memory corruption is defensibly exploitable for arbitrary corruption or control-flow impact.\nA:H - The out-of-bounds kernel write can corrupt heap or stack state and reliably cause an oops, panic, or hang. Repeated local triggering can deny service to the system."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/i2c/busses/i2c-s3c2410.c"],"versions":[{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"fd1650da24ed54c716aa9b69e9bbd8a662e492da","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"8f756a5964396da0fc9e0db33253a5b85dbbcbb6","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"2d262da4bca6fab96e2e709feb95b31b0a9a03a7","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"fa00738ab30b07db1a43b9c85fc56b8cc3b7d197","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"d87d5620125a03b1eadbd5df39748215d3db7ddb","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"377fae22a137b6b89f3f32399a58c52cf2325416","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"71b3c316b22c555d2769126a92b1244b15a9750d","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"c0128c7157d639a931353ea344fb44aad6d6e17a","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/i2c/busses/i2c-s3c2410.c"],"versions":[{"version":"3.10","status":"affected"},{"version":"0","lessThan":"3.10","status":"unaffected","versionType":"semver"},{"version":"5.10.258","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.136","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.83","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.24","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19.14","lessThanOrEqual":"6.19.*","status":"unaffected","versionType":"semver"},{"version":"7.0.1","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"5.10.258"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.6.136"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.12.83"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.18.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.19.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"7.0.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/fd1650da24ed54c716aa9b69e9bbd8a662e492da"},{"url":"https://git.kernel.org/stable/c/8f756a5964396da0fc9e0db33253a5b85dbbcbb6"},{"url":"https://git.kernel.org/stable/c/2d262da4bca6fab96e2e709feb95b31b0a9a03a7"},{"url":"https://git.kernel.org/stable/c/fa00738ab30b07db1a43b9c85fc56b8cc3b7d197"},{"url":"https://git.kernel.org/stable/c/d87d5620125a03b1eadbd5df39748215d3db7ddb"},{"url":"https://git.kernel.org/stable/c/377fae22a137b6b89f3f32399a58c52cf2325416"},{"url":"https://git.kernel.org/stable/c/71b3c316b22c555d2769126a92b1244b15a9750d"},{"url":"https://git.kernel.org/stable/c/aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b"},{"url":"https://git.kernel.org/stable/c/c0128c7157d639a931353ea344fb44aad6d6e17a"}],"title":"i2c: s3c24xx: check the size of the SMBUS message before using it","x_generator":{"engine":"bippy-1.2.0"}}}}