In the Linux kernel’s hwmon driver for the pt5161l sensor, the pt5161l_read_block_data() function allocated a 24‑byte buffer while the I2C SMBus protocol can return up to 32 bytes. This buffer overrun allows a device that supplies the maximum length to corrupt adjacent stack memory, potentially enabling execution of arbitrary code in kernel mode. In addition, the function incorrectly propagates a positive byte count when retries fail due to a length mismatch, causing callers to process stale or incomplete data. The combined flaws represent a stack‑based buffer overflow (CWE‑119) and improper input validation (CWE‑20). The likely attack vector is local hardware access or a malicious I2C device; based on the description, it is inferred that an attacker would need control over the I2C bus to trigger the overflow.

All Linux kernel versions that ship the pt5161l hwmon driver before the commit that introduces the bug fix are affected. Users running any distribution or custom kernel that loads this driver are exposed.

The vulnerability is exploitable when an I2C device returns more data than the buffer can hold or supplies mismatched lengths after all retries are exhausted. Attack requires local access to the I2C bus or control over a malicious device that can send crafted packets; this is inferred because the function operates on hardware input. EPSS is not available and the vulnerability is not listed in CISA KEV. While the CVSS score was not specified, a kernel buffer overflow is normally considered high severity, and the risk is significant for systems that expose the pt5161l sensor.