CVE-2025-39680

In the Linux kernel, the following vulnerability has been resolved:

i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer

The data->block[0] variable comes from user. Without proper check, the variable may be very large to cause an out-of-bounds bug.

Fix this bug by checking the value of data->block[0] first.

1. commit 39244cc75482 ("i2c: ismt: Fix an out-of-bounds bug in ismt_access()")
2. commit 92fbb6d1296f ("i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()")

This vulnerability does not affect Red Hat Enterprise Linux as the Realtek RTL9300 I2C bus driver was introduced in newer upstream kernel releases and is not included in supported Red Hat products. In environments running this specific driver, an unvalidated block transfer length allows a local user to cause out-of-bounds memory access, resulting in a system crash. Because the vulnerable driver code is not present in enterprise kernels, Red Hat systems are not exposed to this flaw.