CVE-2026-98204 - Vulnerability Details

- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()

When chunking writes into SMBus blocks in rmi_smb_write_block(), the
loop calculates block_len using the original total length (len) instead
of the remaining length (cur_len).

If len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32
for every iteration, even on the final partial chunk where fewer than 32
bytes remain. This causes smb_block_write() to read 32 bytes from the
advanced data buffer pointer, reading past the end of the input buffer.

Fix this by calculating block_len using cur_len and advancing the buffer
and address pointers by block_len.

Published: 2026-10-06

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is an out-of-bounds read in the Linux kernel's rmi_smbus driver. The code calculates the block length incorrectly when chunking SMBus writes, causing smb_block_write() to read beyond the end of the supplied buffer. This over-read could lead to a kernel crash or other integrity issues, but no publicly disclosed exploit is known.

Affected Systems

All Linux kernel implementations that include the unpatched rmi_smbus driver are affected. The vendor data lists the kernel as "Linux:Linux", so any distribution kernel that includes this code before the patch is at risk. No specific kernel versions or configurations are listed in the CNA data.

Risk and Exploitability

The CVSS score of 7.0 indicates moderate severity, yet the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The primary impact is an out-of-bounds read that may cause a kernel crash; no active exploit was reported at the time of this analysis.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`82264d0cf7aef2247563c031ff2ab96579d5d0cc`	affected	< d01337c0892d1509500c727edf81380777c2dd0f
`82264d0cf7aef2247563c031ff2ab96579d5d0cc`	affected	< 7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8
`82264d0cf7aef2247563c031ff2ab96579d5d0cc`	affected	< 29fbcf5834f0a7f74bfd017c07da2411b35a4e2a
`82264d0cf7aef2247563c031ff2ab96579d5d0cc`	affected	< 50dd585bee7669eb165e5defcc35d17f3822cfbb
`82264d0cf7aef2247563c031ff2ab96579d5d0cc`	affected	< e022538e13dd1c82af5ec25ac28f12ca0ab26160
`82264d0cf7aef2247563c031ff2ab96579d5d0cc`	affected	< dc05ec97b8299e48e31367a9bc412c7e9c0e2b42
`82264d0cf7aef2247563c031ff2ab96579d5d0cc`	affected	< 9f0ce5e162eed8b68345abe839c59768bc60f99a
`82264d0cf7aef2247563c031ff2ab96579d5d0cc`	affected	< 51cfe54f815ae175c7d1126b983d4d7c89715004

Linux

affected

Version	Status	Constraints
`4.10`	affected	—
`0`	unaffected	< 4.10
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[82264d0cf7aef2247563c031ff2ab96579d5d0cc,d01337c0892d1509500c727edf81380777c2dd0f)`	affected	code_commit	—
`[82264d0cf7aef2247563c031ff2ab96579d5d0cc,7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8)`	affected	code_commit	—
`[82264d0cf7aef2247563c031ff2ab96579d5d0cc,29fbcf5834f0a7f74bfd017c07da2411b35a4e2a)`	affected	code_commit	—
`[82264d0cf7aef2247563c031ff2ab96579d5d0cc,50dd585bee7669eb165e5defcc35d17f3822cfbb)`	affected	code_commit	—
`[82264d0cf7aef2247563c031ff2ab96579d5d0cc,e022538e13dd1c82af5ec25ac28f12ca0ab26160)`	affected	code_commit	—
`[82264d0cf7aef2247563c031ff2ab96579d5d0cc,dc05ec97b8299e48e31367a9bc412c7e9c0e2b42)`	affected	code_commit	—
`[82264d0cf7aef2247563c031ff2ab96579d5d0cc,9f0ce5e162eed8b68345abe839c59768bc60f99a)`	affected	code_commit	—
`[82264d0cf7aef2247563c031ff2ab96579d5d0cc,51cfe54f815ae175c7d1126b983d4d7c89715004)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.10`	affected	generic	—
`[0,4.10)`	unaffected	generic	—
`[5.10.271,5.11.0)`	unaffected	generic	—
`[5.15.222,5.16.0)`	unaffected	generic	—
`[6.1.189,6.2.0)`	unaffected	generic	—
`[6.6.158,6.7.0)`	unaffected	generic	—
`[6.12.112,6.13.0)`	unaffected	generic	—
`[6.18.54,6.19.0)`	unaffected	generic	—
`[7.2.8,7.3.0)`	unaffected	generic	—
`[7.3-rc4,*)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel patch that includes the rmi_smbus out-of-bounds read fix
Rebuild the kernel or configure it to exclude the rmi_smbus module if it is not required
If immediate kernel upgrade is not possible, unload or disable the rmi_smbus module to mitigate potential exploitation

Generated by OpenCVE AI on October 9, 2026 at 14:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98204.mbox
https://git.kernel.org/stable/c/29fbcf5834f0a7f74bfd017c07da2411b35a4e2a
https://git.kernel.org/stable/c/50dd585bee7669eb165e5defcc35d17f3822cfbb
https://git.kernel.org/stable/c/51cfe54f815ae175c7d1126b983d4d7c89715004
https://git.kernel.org/stable/c/7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8
https://git.kernel.org/stable/c/9f0ce5e162eed8b68345abe839c59768bc60f99a
https://git.kernel.org/stable/c/d01337c0892d1509500c727edf81380777c2dd0f
https://git.kernel.org/stable/c/dc05ec97b8299e48e31367a9bc412c7e9c0e2b42
https://git.kernel.org/stable/c/e022538e13dd1c82af5ec25ac28f12ca0ab26160
https://nvd.nist.gov/vuln/detail/CVE-2026-98204
https://www.cve.org/CVERecord?id=CVE-2026-98204

History

Fri, 09 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98204.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98204 https://www.cve.org/CVERecord?id=CVE-2026-98204
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Tue, 06 Oct 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() When chunking writes into SMBus blocks in rmi_smb_write_block(), the loop calculates block_len using the original total length (len) instead of the remaining length (cur_len). If len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32 for every iteration, even on the final partial chunk where fewer than 32 bytes remain. This causes smb_block_write() to read 32 bytes from the advanced data buffer pointer, reading past the end of the input buffer. Fix this by calculating block_len using cur_len and advancing the buffer and address pointers by block_len.
Title		Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/29fbcf5834f0a7f74bfd017c07da2411b35a4e2a https://git.kernel.org/stable/c/50dd585bee7669eb165e5defcc35d17f3822cfbb https://git.kernel.org/stable/c/51cfe54f815ae175c7d1126b983d4d7c89715004 https://git.kernel.org/stable/c/7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8 https://git.kernel.org/stable/c/9f0ce5e162eed8b68345abe839c59768bc60f99a https://git.kernel.org/stable/c/d01337c0892d1509500c727edf81380777c2dd0f https://git.kernel.org/stable/c/dc05ec97b8299e48e31367a9bc412c7e9c0e2b42 https://git.kernel.org/stable/c/e022538e13dd1c82af5ec25ac28f12ca0ab26160

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:44:41.712Z

Updated: 2026-10-19T09:15:35.168Z

Reserved: 2026-09-25T10:25:14.325Z

Link: CVE-2026-98204

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:06.383

Modified: 2026-10-19T10:18:21.060

Link: CVE-2026-98204

Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98204 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-09T14:45:07Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object