SparkAltBatteryBoard

SparkAltBatteryBoard A custom research-oriented battery interface and telemetry board for the DJI Spark platform, built around a standard 3S LiPo battery pack instead of the discontinued, hard-to-find OEM Smart Battery. This project documents a reverse-engineered I2C/SMBus smart-battery...

kernel: i2c: stub: Reject I2C block transfers with invalid length

A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...

CVE-2026-17053

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

CVE-2026-17053

The Zephyr RTOS SMBus driver API contains a vulnerability where smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() are exposed as syscalls. These syscalls fail to perform K_SYSCALL_MEMORY_READ/WRITE validation on the caller-supplied struct smbus_callback *cb pointer, forwarding it direc...

CVE-2026-17053 SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

CVE-2026-17053 SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

EUVD-2026-90880

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

CVE-2026-17053: Missing Authorization

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

CVE-2026-93287

A flaw was found in the Linux kernel's I2C System Management Bus SMBus subsystem. A local user can trigger an out-of-bounds memory read by submitting a transfer request with an oversized or invalid block length. This occurs because the kernel does not properly validate user-supplied transfer...

SUSE CVE-2026-93287

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data-block0 is validated in i2csmbusxferemulated but that check runs too late for tracepoints and is skipped entirely when the adapte...

AZL-103661 CVE-2026-93287 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data-block0 is validated in i2csmbusxferemulated but that check runs too late for tracepoints and is skipped entirely when the adapte...

DEBIAN-CVE-2026-93287

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data-block0 is validated in i2csmbusxferemulated but that check runs too late for tracepoints and is skipped entirely when the adapte...

UBUNTU-CVE-2026-93287

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data-block0 is validated in i2csmbusxferemulated but that check runs too late for tracepoints and is skipped entirely when the adapte...

EUVD-2026-86166

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data-block0 is validated in i2csmbusxferemulated but that check runs too late for tracepoints and is skipped entirely when the adapte...

CVE-2026-93287 i2c: smbus: reject oversized block transfers in the common path

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data-block0 is validated in i2csmbusxferemulated but that check runs too late for tracepoints and is skipped entirely when the adapte...

CVE-2026-93287

The Linux kernel contains a vulnerability where SMBus block transfer lengths are not properly validated in the common path, specifically when using native smbus_xfer implementations. This allows user-controlled oversized block lengths to reach tracepoint memcpy calls and driver callbacks unchecke...

CVE-2026-93287 i2c: smbus: reject oversized block transfers in the common path

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data-block0 is validated in i2csmbusxferemulated but that check runs too late for tracepoints and is skipped entirely when the adapte...

CVE-2026-93287: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data-block0 is validated in i2csmbusxferemulated but that check runs too late for tracepoints and is skipped entirely when the adapte...

CVE-2026-93287

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data-block0 is validated in i2csmbusxferemulated but that check runs too late for tracepoints and is skipped entirely when the adapte...

PT-2026-97974

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMBus block transfer handling where the length specified in data-block0 is not validated early enough. This allows user-controlled oversized block lengths to reach...