The Linux I2C stub driver contains an arithmetic bug that allows a locally privileged user to perform an I2C_SMBUS_I2C_BLOCK_DATA ioctl with a block length beyond the defined on‑chip maximum of 32 bytes. This causes the driver to read or write past the end of its i2c_smbus_data.block buffer, triggering a stack‑out‑of‑bounds error that can corrupt kernel memory or crash the system. Consequently, an attacker with access to a /dev/i2c-* character device can potentially gain kernel code execution or elevate privileges.

Any Linux kernel instance where the CONFIG_I2C_STUB option is compiled as a module and the driver is loaded on a device node exposing a /dev/i2c-* character device. The specific kernel versions are not enumerated in the advisory, so every release containing the unpatched implementation is considered vulnerable.

The vulnerability is local; an attacker must already have access to a character device node on the host, typically restricted to privileged users. The EPSS score indicates a probability of exploitation that is very low (< 1%), and the vulnerability is not listed in the CISA KEV catalog. However, the CVSS score of 7.8 reflects a high severity due to the potential for kernel memory corruption and privilege escalation. If a system exposes /dev/i2c-* device nodes to untrusted local users, the risk rises, but the likelihood remains modest because the attacker requires local access to the specific device.