The kernel driver for the s3c24xx I2C controller processes SMBus messages without first verifying that the size byte declared in the message is within the allowed range defined by I2C_SMBUS_BLOCK_MAX. If an attacker supplies a size value larger than the buffer that will hold the data, the driver copies more bytes than the allocated buffer can contain, corrupting kernel memory and leading to a crash. This is an example of an out‑of‑bounds write that can cause a denial of service. The CVE file lists CWE‑129 as the common weakness associated with this flaw.

The vulnerability is present in the Linux kernel s3c24xx I2C driver. The known affected kernel releases include 3.10 and all newer kernels that have not incorporated the commit that added the size check. The input does not enumerate system models or device families, so the exact hardware impacted beyond the presence of a s3c24xx I2C controller is not specified. Consequently, any system running an affected kernel build with the s3c24xx driver enabled is potentially vulnerable.

The CVSS score of 7.8 indicates a high severity. The EPSS score of <1% suggests a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need to have the ability to inject transactions onto the local I2C bus, which is typically a physical or local privilege condition. The lack of remote exploitation paths reduces the overall risk, but a patched kernel eliminates the crash risk entirely.