The flaw occurs in the Linux kernel I2C driver when handling the I2C_TIMEOUT ioctl. A user can supply a timeout value that passes the initial INT_MAX check but, after being multiplied by ten, overflows a 32‑bit integer. The truncated result is then cast to a signed 32‑bit value, interpreted as a negative number, and used in a wait_for_completion_timeout call. The negative value is sign‑extended to an unsigned 64‑bit variable, causing the scheduler to emit a warning and return prematurely, leaving the SMBus controller in an unrecoverable state. An attacker can exploit this locally to trigger a denial of service on an affected device.

All Linux kernel systems that include the i2c-dev driver are affected. The vulnerability is present in any kernel version that has the bug in the I2C_TIMEOUT ioctl handling before the patch that limits the input to INT_MAX/10. Specific version ranges are not listed, so any unpatched kernel should be considered vulnerable.

The issue is local; a user with access to the /dev/i2c* device can trigger the overflow. The EPSS score is unavailable and the vulnerability is not in CISA KEV, but the CVSS severity is implied to be high due to the direct local denial of service and the likelihood of exploitation via a standard ioctl interface. The bug can be triggered without special privileges beyond those required to access the device, so any untrusted process that can open the device risks bringing the system to a stopped state by corrupting the SMBus state machine.