In the Linux kernel hwmon driver for the pt5161l sensor, the pt5161l_read_block_data() function declared a 24‑byte buffer but the I2C SMBus protocol can return up to 32 bytes. When a device supplies the maximum length, the kernel copies the data before validating the length, allowing a stack overrun that can corrupt adjacent memory. A second flaw causes the function to return a positive byte count even when retries fail due to an unexpected length, leading callers to process stale or incomplete data. These issues represent a stack-based buffer overflow (CWE‑119) and improper length validation (CWE‑20).

All Linux kernel versions that include the pt5161l hwmon driver before the commit that fixes the bugs are affected. Systems running any distribution or custom kernel that loads this driver are exposed, regardless of version.

The vulnerability is exploitable when an I2C device returns more data than the buffer can hold or provides mismatched lengths after all retries. The likely attack vector is local hardware access or a malicious device on the I2C bus, so an attacker would need control over that bus. EPSS is not available and the issue is not listed in the CISA KEV catalog. Without an explicit CVSS score, the risk is considered significant for kernel integrity, but the precise severity cannot be quantified from the supplied data.