CVE-2026-93287
Description
A flaw was found in the Linux kernel's I2C System Management Bus (SMBus) subsystem. A local user can trigger an out-of-bounds memory read by submitting a transfer request with an oversized or invalid block length. This occurs because the kernel does not properly validate user-supplied transfer lengths before passing the data to internal logging functions and device drivers. An attacker can exploit this vulnerability to cause a Denial of Service (DoS) via a system crash or potentially disclose sensitive kernel memory.
Statement
Red Hat Product Security rates this Linux kernel flaw as having Moderate security impact. A flaw was found in the kernel's I2C SMBus subsystem in which caller-supplied SMBus block transfer lengths were not validated early in __i2c_smbus_xfer(). A local user with access to an I2C character device (/dev/i2c-*) could submit an oversized block length through an ioctl, and the unvalidated length could reach the smbus_write tracepoint and native smbus_xfer driver callbacks (such as i2c-stub) unchecked, causing out-of-bounds memory reads beyond the 34-byte SMBus data buffer. This can crash the kernel, resulting in a denial of service, and potentially disclose sensitive kernel memory. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels; the affected RHEL 8, 9, and 10 kernel and kernel-rt streams, Red Hat In-Vehicle OS, and OpenShift RHCOS-based streams are marked affected with the fix deferred. The residual risk of deferring is limited because exploitation requires local access to I2C device nodes, which is typically restricted to privileged users, and the primary demonstrated impact is denial of service. Red Hat's severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the upstream CVE.org score of 7.8 (Important) because no meaningful confidentiality or integrity impact has been demonstrated and the impact is assessed as availability only.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
