Technical impact
The defect occurs in the Linux kernel’s hwmon subsystem when the tps53679 driver attempts to read data from an I2C‑connected sensor. The i2c_smbus_read_block_data() function can return 0 to indicate a zero‑length block read; the driver incorrectly indexes the buffer as buf[ret–1], which becomes buf[-1] when ret is zero. This causes an out‑of‑bounds read of a byte that resides just before the kernel stack frame. The read could leak small amounts of sensitive stack data or, in rare cases, trigger a kernel fault that may lead to a crash. The vulnerability does not provide a direct code‑execution path. Based on the description, it is inferred that the attack vector requires local access to the I2C device, meaning an attacker would need privileged or local user access to invoke the driver’s read routine. Because no exploit has been published and the vulnerability is not listed in the CISA KEV catalog, the overall risk is considered moderate. The EPSS score of less than 1% suggests a very low probability of exploitation. Risk and exploitation are limited to users who can interact with the device; arbitrary local users are normally restricted via device permissions. Patching the kernel to the version that changes the check from 'ret < 0' to 'ret <= 0' removes the flaw entirely.
Affected Systems
All Linux kernel releases before the commit that updates the tps53679 driver to treat a zero‑length I2C block read as an error are affected. The flaw resides solely in the tps53679 driver within the hwmon subsystem and does not impact other sensors or kernel subsystems.
Risk and Exploitability
The flaw requires an attacker to invoke the driver’s read operation on a device that returns a zero‑length block read. This typically means the user must have local access to the I2C bus and sufficient privileges to map or read the device file. The vulnerability does not directly grant arbitrary code execution, but it can disclose kernel data or cause a kernel crash. With the vulnerability not found in an active exploit database or listed in KEV, the threat remains moderate until an exploit materializes. The CVSS score is 7.1, indicating a high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation.
