{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31627","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-03-09T15:48:24.124Z","datePublished":"2026-04-24T14:42:48.342Z","dateUpdated":"2026-05-11T22:12:28.210Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T22:12:28.210Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: s3c24xx: check the size of the SMBUS message before using it\n\nThe first byte of an i2c SMBUS message is the size, and it should be\nverified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX\nbefore processing it.\n\nThis is the same logic that was added in commit a6e04f05ce0b (\"i2c:\ntegra: check msg length in SMBUS block read\") to the i2c tegra driver."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"}}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/i2c/busses/i2c-s3c2410.c"],"versions":[{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"fa00738ab30b07db1a43b9c85fc56b8cc3b7d197","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"d87d5620125a03b1eadbd5df39748215d3db7ddb","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"377fae22a137b6b89f3f32399a58c52cf2325416","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"71b3c316b22c555d2769126a92b1244b15a9750d","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b","status":"affected","versionType":"git"},{"version":"85747311ecb6167c989093c64a13807366fdd3a9","lessThan":"c0128c7157d639a931353ea344fb44aad6d6e17a","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/i2c/busses/i2c-s3c2410.c"],"versions":[{"version":"3.10","status":"affected"},{"version":"0","lessThan":"3.10","status":"unaffected","versionType":"semver"},{"version":"6.6.136","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.83","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.24","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19.14","lessThanOrEqual":"6.19.*","status":"unaffected","versionType":"semver"},{"version":"7.0.1","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.6.136"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.12.83"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.18.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.19.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"7.0.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"7.1-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/fa00738ab30b07db1a43b9c85fc56b8cc3b7d197"},{"url":"https://git.kernel.org/stable/c/d87d5620125a03b1eadbd5df39748215d3db7ddb"},{"url":"https://git.kernel.org/stable/c/377fae22a137b6b89f3f32399a58c52cf2325416"},{"url":"https://git.kernel.org/stable/c/71b3c316b22c555d2769126a92b1244b15a9750d"},{"url":"https://git.kernel.org/stable/c/aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b"},{"url":"https://git.kernel.org/stable/c/c0128c7157d639a931353ea344fb44aad6d6e17a"}],"title":"i2c: s3c24xx: check the size of the SMBUS message before using it","x_generator":{"engine":"bippy-1.2.0"}}}}