HIGH Introduced in 4.15
w1 BlockRead OOB
CVE-2026-80931
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the device. The downstream slave puts a length byte in buf[0]. The driver then reads that many bytes into buf[1] with w1_f19_i2c_read(). buf[0] is controlled by the device and can be 0 to 255. w1_f19_i2c_read() only rejects a zero count. The caller buffer is I2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That check runs after master_xfer returns. By then the write is already done. i2c-algo-bit rejects an oversize length before it copies, and returns -EPROTO. Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the same way i2c-algo-bit does.
02KernelScan AI Analysis
Risk summary
A malicious I2C slave device connected behind a DS28E17 1-Wire-to-I2C bridge can supply an oversized length byte during a block read, causing the kernel driver to write up to ~222 bytes past the end of a 34-byte buffer. This results in kernel memory corruption that can lead to information disclosure, privilege escalation, or a system crash. The attack requires physical access to the 1-Wire or I2C bus and the DS28E17 hardware to be present and configured.
Vulnerability analysis
The DS28E17 1-Wire-to-I2C bridge driver trusts a length byte supplied by the I2C slave device during SMBus block reads and uses it directly to determine how many bytes to copy into the caller's buffer. That buffer is only 34 bytes, but the device-controlled length can be up to 255, causing an out-of-bounds write of up to roughly 222 bytes into adjacent kernel memory. The SMBus core validates this length only after the transfer has already completed, so the corruption happens before any check. The fix rejects any length exceeding the SMBus block maximum before the read is performed, returning a protocol error the same way other I2C algorithm drivers already do. The vulnerability is reachable only from a malicious I2C device on the bus behind a DS28E17 bridge, which requires physical access to the 1-Wire or I2C bus and the specific DS28E17 hardware to be present.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.15 | 5.10.270 | b30c021c6073 |
| 5.15 | 4.15 | 5.15.221 | 1d08877fc37e |
| 6.1 | 4.15 | 6.1.188 | bf76d61e118b |
| 6.12 | 4.15 | 6.12.109 | cb55c5da9828 |
| 6.18 | 4.15 | 6.18.50 | ae0c79a85270 |
| 6.6 | 4.15 | 6.6.157 | 0f6496b34cc2 |
| 7.2 | 4.15 | 7.2.4 | 6df05f630c84 |
| mainline | 4.15 | 7.3 | 169ae5e65e5a |
| cip/5.10 | 4.15 | 5.10.271-cip78 | b30c021c6073 |
| cip/6.1 | 4.15 | 6.1.189-cip61 | bf76d61e118b |
| cip/6.1-rt | 4.15 | 6.1.189-cip61-rt32 | bf76d61e118b |
| cip/6.12 | 4.15 | 6.12.111-cip32 | cb55c5da9828 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |