CVE-2025-39928

In the Linux kernel, the following vulnerability has been resolved:

i2c: rtl9300: ensure data length is within supported range

Add an explicit check for the xfer length to 'rtl9300_i2c_config_xfer' to ensure the data length isn't within the supported range. In particular a data length of 0 is not supported by the hardware and causes unintended or destructive behaviour.

This limitation becomes obvious when looking at the register documentation [1]. 4 bits are reserved for DATA_WIDTH and the value of these 4 bits is used as N + 1, allowing a data length range of 1 <= len <= 16.

Affected by this is the SMBus Quick Operation which works with a data length of 0. Passing 0 as the length causes an underflow of the value due to:

(len - 1) & 0xf

and effectively specifying a transfer length of 16 via the registers. This causes a 16-byte write operation instead of a Quick Write. For example, on SFP modules without write-protected EEPROM this soft-bricks them by overwriting some initial bytes.

For completeness, also add a quirk for the zero length.

[1] https://svanheule.net/realtek/longan/register/i2c_mst1_ctrl2

This vulnerability does not impact Red Hat Enterprise Linux products as the affected Realtek RTL9300 I2C driver is not present in supported Red Hat kernels. The issue stems from insufficient transfer length validation introduced in upstream Linux 6.13, which is absent from enterprise distributions. As a result, Red Hat environments are not exposed to unintended bus write operations or potential device corruption associated with this flaw.