Description
In the Linux kernel, the following vulnerability has been resolved:

w1: ds28e17: reject an oversize length on an I2C block read

w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire
to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the
device. The downstream slave puts a length byte in buf[0]. The driver
then reads that many bytes into buf[1] with w1_f19_i2c_read().

buf[0] is controlled by the device and can be 0 to 255.
w1_f19_i2c_read() only rejects a zero count. The caller buffer is
I2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read
run past it, up to about 222 bytes out of bounds.

The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That
check runs after master_xfer returns. By then the write is already
done. i2c-algo-bit rejects an oversize length before it copies, and
returns -EPROTO.

Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the
same way i2c-algo-bit does.
Published: 2026-09-11
Score: 4.7 Medium
EPSS: n/a
KEV: No
Impact: Out‑of‑bounds read via an oversized I²C block read
Action: Assess Impact
AI Analysis

Impact

The DS28E17 1‑Wire to I²C bridge driver allows a device to supply a length byte that can be as large as 255. The kernel driver copies that many bytes into a 34‑byte buffer, causing a read past the end of the buffer up to about 222 bytes. This out‑of‑bounds read can expose kernel memory contents, potentially leaking sensitive information. The flaw is a classic unchecked buffer read represented by CWE‑125.

Affected Systems

All Linux kernel installations that load the w1: ds28e17 driver are affected. No specific kernel version range is listed, but the vulnerability is present in any kernel build that includes the unpatched driver code referenced in the commit logs.

Risk and Exploitability

The CVSS score of 4.7 reflects a moderate impact and low to medium exploitability. The EPSS metric is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local attacker that can send I²C commands to the DS28E17 device or a malicious device that gains temporary access to the I²C bus. Because the flaw requires direct interaction with the hardware interface, it is not remotely exploitable over a network.

Generated by OpenCVE AI on September 12, 2026 at 01:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the patch rejecting oversize I²C block read lengths, as applied in the referenced commit(s).
  • Verify that kernel configuration and device drivers perform a length check before invoking i2c_master_xfer, mirroring the logic used by i2c-algo-bit.
  • If an immediate kernel update is not possible, restrict physical access to the I²C bus or configure the system to allow I²C communication only with trusted devices to prevent malicious oversized length values from being transmitted.

Generated by OpenCVE AI on September 12, 2026 at 01:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the device. The downstream slave puts a length byte in buf[0]. The driver then reads that many bytes into buf[1] with w1_f19_i2c_read(). buf[0] is controlled by the device and can be 0 to 255. w1_f19_i2c_read() only rejects a zero count. The caller buffer is I2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That check runs after master_xfer returns. By then the write is already done. i2c-algo-bit rejects an oversize length before it copies, and returns -EPROTO. Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the same way i2c-algo-bit does.
Title w1: ds28e17: reject an oversize length on an I2C block read
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-11T19:42:06.272Z

Reserved: 2026-08-26T14:34:25.802Z

Link: CVE-2026-80931

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:18:56.893

Modified: 2026-09-11T20:18:56.893

Link: CVE-2026-80931

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:42:06Z

Links: CVE-2026-80931 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-12T02:00:07Z

Weaknesses