CVE-2026-93287

A flaw was found in the Linux kernel's I2C System Management Bus (SMBus) subsystem. A local user can trigger an out-of-bounds memory read by submitting a transfer request with an oversized or invalid block length. This occurs because the kernel does not properly validate user-supplied transfer lengths before passing the data to internal logging functions and device drivers. An attacker can exploit this vulnerability to cause a Denial of Service (DoS) via a system crash or potentially disclose sensitive kernel memory.

Red Hat Product Security rates this Linux kernel flaw as having Moderate security impact. A flaw was found in the kernel's I2C SMBus subsystem in which caller-supplied SMBus block transfer lengths were not validated early in __i2c_smbus_xfer(). A local user with access to an I2C character device (/dev/i2c-*) could submit an oversized block length through an ioctl, and the unvalidated length could reach the smbus_write tracepoint and native smbus_xfer driver callbacks (such as i2c-stub) unchecked, causing out-of-bounds memory reads beyond the 34-byte SMBus data buffer. This can crash the kernel, resulting in a denial of service, and potentially disclose sensitive kernel memory. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels; the affected RHEL 8, 9, and 10 kernel and kernel-rt streams, Red Hat In-Vehicle OS, and OpenShift RHCOS-based streams are marked affected with the fix deferred. The residual risk of deferring is limited because exploitation requires local access to I2C device nodes, which is typically restricted to privileged users, and the primary demonstrated impact is denial of service. Red Hat's severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the upstream CVE.org score of 7.8 (Important) because no meaningful confidentiality or integrity impact has been demonstrated and the impact is assessed as availability only.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.