CVE-2026-64191

The CVE-2026-64191 issue affects the Linux kernel I2C stub driver (CONFIG_I2C_STUB=m). In stub_xfer(), the I2C_SMBUS_I2C_BLOCK_DATA path uses data->block[0] as the transfer length without validating against I2C_SMBUS_BLOCK_MAX (32). This allows reads/writes past the end of the i2c_smbus_data.b...

CVE-2026-64191 i2c: stub: Reject I2C block transfers with invalid length

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check only clamps it to avoid overrunning the chip-words256 register array,...