{
"schema_version": "1.6.1",
"id": "RPI-CVE-2026-93287",
"modified": "2026-10-09T11:39:44Z",
"upstream": [
"CVE-2026-93287"
],
"published": "2026-09-24T16:08:25Z",
"summary": "i2c: smbus: reject oversized block transfers in the common path",
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: smbus: reject oversized block transfers in the common path\n\nThe SMBus block transfer length data->block[0] is validated in\ni2c_smbus_xfer_emulated() but that check runs too late for tracepoints\nand is skipped entirely when the adapter provides a native smbus_xfer\nimplementation. This allows user-controlled oversized block lengths to\nreach tracepoint memcpy calls and driver callbacks unchecked.\n\nAdd an early validation in __i2c_smbus_xfer() that rejects block\ntransfers whose caller-supplied length is zero or exceeds\nI2C_SMBUS_BLOCK_MAX before any tracepoint fires or driver callback\nruns. data->block[0] is filled in by the device on SMBus block reads,\nso the check is scoped to operations where the length is actually\nsupplied by the caller. This is consistent with the existing -EINVAL\nconvention in the emulated path and protects all downstream consumers\nat once: the smbus_write tracepoint, all native smbus_xfer driver\nimplementations, and the emulated path.\n\nTwo distinct bugs are fixed by this change:\n\nBug 1: smbus_write tracepoint OOB (include/trace/events/smbus.h)\n trace_smbus_write() fires before any validation and copies\n data->block[0]+1 bytes into a 34-byte event buffer. With\n block[0]=0xfe the tracepoint copies 255 bytes, overflowing by 221.\n\n BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_smbus_write+0x27c/0x530\n Read of size 255 at addr ffff88800d98fcf8 by task poc_smbus/91\n Call Trace:\n \n __asan_memcpy+0x23/0x80\n trace_event_raw_event_smbus_write+0x27c/0x530\n __i2c_smbus_xfer+0x43a/0xa40\n i2c_smbus_xfer+0x19e/0x340\n i2cdev_ioctl_smbus+0x38f/0x7f0\n i2cdev_ioctl+0x35e/0x680\n __x64_sys_ioctl+0x147/0x1e0\n do_syscall_64+0xcf/0x15a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n \n\nBug 2: i2c-stub I2C_SMBUS_I2C_BLOCK_DATA OOB (drivers/i2c/i2c-stub.c)\n stub_xfer() implements .smbus_xfer directly and only clamps\n block[0] against 256-command, not I2C_SMBUS_BLOCK_MAX. With\n block[0]=0xff and command=0 the loop accesses block[1+i] for\n i up to 254, far past the 34-byte union.\n\n UBSAN: array-index-out-of-bounds in drivers/i2c/i2c-stub.c:223:44\n index 34 is out of range for type '__u8 [34]'\n Call Trace:\n \n __ubsan_handle_out_of_bounds+0xd7/0x120\n stub_xfer+0x1971/0x198f [i2c_stub]\n __i2c_smbus_xfer+0x306/0xa40\n i2c_smbus_xfer+0x19e/0x340\n i2cdev_ioctl_smbus+0x38f/0x7f0\n i2cdev_ioctl+0x35e/0x680\n __x64_sys_ioctl+0x147/0x1e0\n do_syscall_64+0xcf/0x15a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n \n\nBoth traces reproduced on v7.0-rc6+i2c/for-current with KASAN+UBSAN.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Raspberry Pi OS:12",
"name": "linux"
},
"versions": [
"1:6.1.21-1+rpt1",
"1:6.1.47-1+rpt2",
"1:6.1.47-1+rpt4",
"1:6.1.54-1+rpt2",
"1:6.1.58-1+rpt2",
"1:6.1.63-1+rpt1",
"1:6.1.73-1+rpt1",
"1:6.6.20-1+rpt1",
"1:6.6.28-1+rpt1",
"1:6.6.31-1+rpt1",
"1:6.6.47-1+rpt1",
"1:6.6.51-1+rpt1",
"1:6.6.51-1+rpt2",
"1:6.6.51-1+rpt3",
"1:6.6.62-1+rpt1",
"1:6.6.74-1+rpt1",
"1:6.12.20-1+rpt1~bpo12+1",
"1:6.12.25-1+rpt1",
"1:6.12.34-1+rpt1~bookworm",
"1:6.12.47-1+rpt1~bookworm",
"1:6.12.62-1+rpt1~bookworm",
"1:6.12.75-1+rpt1~bookworm",
"1:6.12.87-1+rpt1~bookworm",
"1:6.12.93-1+rpt1",
"1:6.12.96-1+rpt1",
"1:6.12.109-1+rpt1"
],
"ecosystem_specific": {
"binaries": [
{
"binary_name": "linux-image-6.1.0-rpi1-rpi-v6",
"binary_version": "1:6.1.21-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi1-rpi-v7",
"binary_version": "1:6.1.21-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi1-rpi-v7l",
"binary_version": "1:6.1.21-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi1-rpi-v8",
"binary_version": "1:6.1.21-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi2-rpi-v6",
"binary_version": "1:6.1.47-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi2-rpi-v7",
"binary_version": "1:6.1.47-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi2-rpi-v7l",
"binary_version": "1:6.1.47-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi2-rpi-v8",
"binary_version": "1:6.1.47-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
"binary_version": "1:6.1.47-1+rpt4"
},
{
"binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
"binary_version": "1:6.1.47-1+rpt4"
},
{
"binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
"binary_version": "1:6.1.47-1+rpt4"
},
{
"binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
"binary_version": "1:6.1.47-1+rpt4"
},
{
"binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
"binary_version": "1:6.1.47-1+rpt4"
},
{
"binary_name": "linux-image-6.1.0-rpi4-rpi-2712",
"binary_version": "1:6.1.54-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi4-rpi-v6",
"binary_version": "1:6.1.54-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi4-rpi-v7",
"binary_version": "1:6.1.54-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi4-rpi-v7l",
"binary_version": "1:6.1.54-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi4-rpi-v8",
"binary_version": "1:6.1.54-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi6-rpi-2712",
"binary_version": "1:6.1.58-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi6-rpi-v6",
"binary_version": "1:6.1.58-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi6-rpi-v7",
"binary_version": "1:6.1.58-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi6-rpi-v7l",
"binary_version": "1:6.1.58-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi6-rpi-v8",
"binary_version": "1:6.1.58-1+rpt2"
},
{
"binary_name": "linux-image-6.1.0-rpi7-rpi-2712",
"binary_version": "1:6.1.63-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi7-rpi-v6",
"binary_version": "1:6.1.63-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi7-rpi-v7",
"binary_version": "1:6.1.63-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi7-rpi-v7l",
"binary_version": "1:6.1.63-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi7-rpi-v8",
"binary_version": "1:6.1.63-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi8-rpi-2712",
"binary_version": "1:6.1.73-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi8-rpi-v6",
"binary_version": "1:6.1.73-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi8-rpi-v7",
"binary_version": "1:6.1.73-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi8-rpi-v7l",
"binary_version": "1:6.1.73-1+rpt1"
},
{
"binary_name": "linux-image-6.1.0-rpi8-rpi-v8",
"binary_version": "1:6.1.73-1+rpt1"
},
{
"binary_name": "linux-image-6.6.20+rpt-rpi-2712",
"binary_version": "1:6.6.20-1+rpt1"
},
{
"binary_name": "linux-image-6.6.20+rpt-rpi-v6",
"binary_version": "1:6.6.20-1+rpt1"
},
{
"binary_name": "linux-image-6.6.20+rpt-rpi-v7",
"binary_version": "1:6.6.20-1+rpt1"
},
{
"binary_name": "linux-image-6.6.20+rpt-rpi-v7l",
"binary_version": "1:6.6.20-1+rpt1"
},
{
"binary_name": "linux-image-6.6.20+rpt-rpi-v8",
"binary_version": "1:6.6.20-1+rpt1"
},
{
"binary_name": "linux-image-6.6.28+rpt-rpi-2712",
"binary_version": "1:6.6.28-1+rpt1"
},
{
"binary_name": "linux-image-6.6.28+rpt-rpi-v6",
"binary_version": "1:6.6.28-1+rpt1"
},
{
"binary_name": "linux-image-6.6.28+rpt-rpi-v7",
"binary_version": "1:6.6.28-1+rpt1"
},
{
"binary_name": "linux-image-6.6.28+rpt-rpi-v7l",
"binary_version": "1:6.6.28-1+rpt1"
},
{
"binary_name": "linux-image-6.6.28+rpt-rpi-v8",
"binary_version": "1:6.6.28-1+rpt1"
},
{
"binary_name": "linux-image-6.6.31+rpt-rpi-2712",
"binary_version": "1:6.6.31-1+rpt1"
},
{
"binary_name": "linux-image-6.6.31+rpt-rpi-v6",
"binary_version": "1:6.6.31-1+rpt1"
},
{
"binary_name": "linux-image-6.6.31+rpt-rpi-v7",
"binary_version": "1:6.6.31-1+rpt1"
},
{
"binary_name": "linux-image-6.6.31+rpt-rpi-v7l",
"binary_version": "1:6.6.31-1+rpt1"
},
{
"binary_name": "linux-image-6.6.31+rpt-rpi-v8",
"binary_version": "1:6.6.31-1+rpt1"
},
{
"binary_name": "linux-image-6.6.47+rpt-rpi-2712",
"binary_version": "1:6.6.47-1+rpt1"
},
{
"binary_name": "linux-image-6.6.47+rpt-rpi-v6",
"binary_version": "1:6.6.47-1+rpt1"
},
{
"binary_name": "linux-image-6.6.47+rpt-rpi-v7",
"binary_version": "1:6.6.47-1+rpt1"
},
{
"binary_name": "linux-image-6.6.47+rpt-rpi-v7l",
"binary_version": "1:6.6.47-1+rpt1"
},
{
"binary_name": "linux-image-6.6.47+rpt-rpi-v8",
"binary_version": "1:6.6.47-1+rpt1"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-2712",
"binary_version": "1:6.6.51-1+rpt1"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-v6",
"binary_version": "1:6.6.51-1+rpt1"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-v7",
"binary_version": "1:6.6.51-1+rpt1"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-v7l",
"binary_version": "1:6.6.51-1+rpt1"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-v8",
"binary_version": "1:6.6.51-1+rpt1"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-2712",
"binary_version": "1:6.6.51-1+rpt2"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-v6",
"binary_version": "1:6.6.51-1+rpt2"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-v7",
"binary_version": "1:6.6.51-1+rpt2"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-v7l",
"binary_version": "1:6.6.51-1+rpt2"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-v8",
"binary_version": "1:6.6.51-1+rpt2"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-2712",
"binary_version": "1:6.6.51-1+rpt3"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-v6",
"binary_version": "1:6.6.51-1+rpt3"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-v7",
"binary_version": "1:6.6.51-1+rpt3"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-v7l",
"binary_version": "1:6.6.51-1+rpt3"
},
{
"binary_name": "linux-image-6.6.51+rpt-rpi-v8",
"binary_version": "1:6.6.51-1+rpt3"
},
{
"binary_name": "linux-image-6.6.62+rpt-rpi-2712",
"binary_version": "1:6.6.62-1+rpt1"
},
{
"binary_name": "linux-image-6.6.62+rpt-rpi-v6",
"binary_version": "1:6.6.62-1+rpt1"
},
{
"binary_name": "linux-image-6.6.62+rpt-rpi-v7",
"binary_version": "1:6.6.62-1+rpt1"
},
{
"binary_name": "linux-image-6.6.62+rpt-rpi-v7l",
"binary_version": "1:6.6.62-1+rpt1"
},
{
"binary_name": "linux-image-6.6.62+rpt-rpi-v8",
"binary_version": "1:6.6.62-1+rpt1"
},
{
"binary_name": "linux-image-6.6.74+rpt-rpi-2712",
"binary_version": "1:6.6.74-1+rpt1"
},
{
"binary_name": "linux-image-6.6.74+rpt-rpi-v6",
"binary_version": "1:6.6.74-1+rpt1"
},
{
"binary_name": "linux-image-6.6.74+rpt-rpi-v7",
"binary_version": "1:6.6.74-1+rpt1"
},
{
"binary_name": "linux-image-6.6.74+rpt-rpi-v7l",
"binary_version": "1:6.6.74-1+rpt1"
},
{
"binary_name": "linux-image-6.6.74+rpt-rpi-v8",
"binary_version": "1:6.6.74-1+rpt1"
},
{
"binary_name": "linux-image-6.12.20+rpt-rpi-2712",
"binary_version": "1:6.12.20-1+rpt1~bpo12+1"
},
{
"binary_name": "linux-image-6.12.20+rpt-rpi-v6",
"binary_version": "1:6.12.20-1+rpt1~bpo12+1"
},
{
"binary_name": "linux-image-6.12.20+rpt-rpi-v7",
"binary_version": "1:6.12.20-1+rpt1~bpo12+1"
},
{
"binary_name": "linux-image-6.12.20+rpt-rpi-v7l",
"binary_version": "1:6.12.20-1+rpt1~bpo12+1"
},
{
"binary_name": "linux-image-6.12.20+rpt-rpi-v8",
"binary_version": "1:6.12.20-1+rpt1~bpo12+1"
},
{
"binary_name": "linux-image-6.12.25+rpt-rpi-2712",
"binary_version": "1:6.12.25-1+rpt1"
},
{
"binary_name": "linux-image-6.12.25+rpt-rpi-v6",
"binary_version": "1:6.12.25-1+rpt1"
},
{
"binary_name": "linux-image-6.12.25+rpt-rpi-v7",
"binary_version": "1:6.12.25-1+rpt1"
},
{
"binary_name": "linux-image-6.12.25+rpt-rpi-v7l",
"binary_version": "1:6.12.25-1+rpt1"
},
{
"binary_name": "linux-image-6.12.25+rpt-rpi-v8",
"binary_version": "1:6.12.25-1+rpt1"
},
{
"binary_name": "linux-image-6.12.34+rpt-rpi-2712",
"binary_version": "1:6.12.34-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.34+rpt-rpi-v6",
"binary_version": "1:6.12.34-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.34+rpt-rpi-v7",
"binary_version": "1:6.12.34-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.34+rpt-rpi-v7l",
"binary_version": "1:6.12.34-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.34+rpt-rpi-v8",
"binary_version": "1:6.12.34-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.34+rpt-rpi-v8-rt",
"binary_version": "1:6.12.34-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.47+rpt-rpi-2712",
"binary_version": "1:6.12.47-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.47+rpt-rpi-v6",
"binary_version": "1:6.12.47-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.47+rpt-rpi-v7",
"binary_version": "1:6.12.47-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.47+rpt-rpi-v7l",
"binary_version": "1:6.12.47-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.47+rpt-rpi-v8",
"binary_version": "1:6.12.47-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.47+rpt-rpi-v8-rt",
"binary_version": "1:6.12.47-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.62+rpt-rpi-2712",
"binary_version": "1:6.12.62-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.62+rpt-rpi-v6",
"binary_version": "1:6.12.62-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.62+rpt-rpi-v7",
"binary_version": "1:6.12.62-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.62+rpt-rpi-v7l",
"binary_version": "1:6.12.62-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.62+rpt-rpi-v8",
"binary_version": "1:6.12.62-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.62+rpt-rpi-v8-rt",
"binary_version": "1:6.12.62-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.75+rpt-rpi-2712",
"binary_version": "1:6.12.75-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.75+rpt-rpi-v6",
"binary_version": "1:6.12.75-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.75+rpt-rpi-v7",
"binary_version": "1:6.12.75-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.75+rpt-rpi-v7l",
"binary_version": "1:6.12.75-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.75+rpt-rpi-v8",
"binary_version": "1:6.12.75-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.75+rpt-rpi-v8-rt",
"binary_version": "1:6.12.75-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.87+rpt-rpi-2712",
"binary_version": "1:6.12.87-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.87+rpt-rpi-v6",
"binary_version": "1:6.12.87-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.87+rpt-rpi-v7",
"binary_version": "1:6.12.87-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.87+rpt-rpi-v7l",
"binary_version": "1:6.12.87-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.87+rpt-rpi-v8",
"binary_version": "1:6.12.87-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.87+rpt-rpi-v8-rt",
"binary_version": "1:6.12.87-1+rpt1~bookworm"
},
{
"binary_name": "linux-image-6.12.93+rpt-rpi-2712",
"binary_version": "1:6.12.93-1+rpt1"
},
{
"binary_name": "linux-image-6.12.93+rpt-rpi-v6",
"binary_version": "1:6.12.93-1+rpt1"
},
{
"binary_name": "linux-image-6.12.93+rpt-rpi-v7",
"binary_version": "1:6.12.93-1+rpt1"
},
{
"binary_name": "linux-image-6.12.93+rpt-rpi-v7l",
"binary_version": "1:6.12.93-1+rpt1"
},
{
"binary_name": "linux-image-6.12.93+rpt-rpi-v8",
"binary_version": "1:6.12.93-1+rpt1"
},
{
"binary_name": "linux-image-6.12.93+rpt-rpi-v8-rt",
"binary_version": "1:6.12.93-1+rpt1"
},
{
"binary_name": "linux-image-6.12.96+rpt-rpi-2712",
"binary_version": "1:6.12.96-1+rpt1"
},
{
"binary_name": "linux-image-6.12.96+rpt-rpi-v6",
"binary_version": "1:6.12.96-1+rpt1"
},
{
"binary_name": "linux-image-6.12.96+rpt-rpi-v7",
"binary_version": "1:6.12.96-1+rpt1"
},
{
"binary_name": "linux-image-6.12.96+rpt-rpi-v7l",
"binary_version": "1:6.12.96-1+rpt1"
},
{
"binary_name": "linux-image-6.12.96+rpt-rpi-v8",
"binary_version": "1:6.12.96-1+rpt1"
},
{
"binary_name": "linux-image-6.12.96+rpt-rpi-v8-rt",
"binary_version": "1:6.12.96-1+rpt1"
},
{
"binary_name": "linux-image-6.12.109+rpt-rpi-2712",
"binary_version": "1:6.12.109-1+rpt1"
},
{
"binary_name": "linux-image-6.12.109+rpt-rpi-v6",
"binary_version": "1:6.12.109-1+rpt1"
},
{
"binary_name": "linux-image-6.12.109+rpt-rpi-v7",
"binary_version": "1:6.12.109-1+rpt1"
},
{
"binary_name": "linux-image-6.12.109+rpt-rpi-v7l",
"binary_version": "1:6.12.109-1+rpt1"
},
{
"binary_name": "linux-image-6.12.109+rpt-rpi-v8",
"binary_version": "1:6.12.109-1+rpt1"
},
{
"binary_name": "linux-image-6.12.109+rpt-rpi-v8-rt",
"binary_version": "1:6.12.109-1+rpt1"
}
]
},
"database_specific": {
"per_version": {
"1:6.1.21-1+rpt1": {
"linux_commit": "0afb5e98488aed7017b9bf321b575d0177feb7ed",
"upstream_version": "6.1.21",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.1.189"
},
"1:6.1.47-1+rpt2": {
"linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
"upstream_version": "6.1.47",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.1.189"
},
"1:6.1.47-1+rpt4": {
"linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
"upstream_version": "6.1.47",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.1.189",
"compiled_filter": false
},
"1:6.1.54-1+rpt2": {
"linux_commit": "2906f7abdc03d4a92b6b0e2e0c87ea2a9dffe8f7",
"upstream_version": "6.1.54",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.1.189"
},
"1:6.1.58-1+rpt2": {
"linux_commit": "ccf1586ad0663fa91238ac56abf6340d6d740d18",
"upstream_version": "6.1.58",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.1.189"
},
"1:6.1.63-1+rpt1": {
"linux_commit": null,
"upstream_version": "6.1.63",
"assessment": "upstream version (no usable Linux commit)",
"upstream_fixed": "6.1.189"
},
"1:6.1.73-1+rpt1": {
"linux_commit": null,
"upstream_version": "6.1.73",
"assessment": "upstream version (no usable Linux commit)",
"upstream_fixed": "6.1.189"
},
"1:6.6.20-1+rpt1": {
"linux_commit": "6f16847710cc0502450788b9f12f0a14d3429668",
"upstream_version": "6.6.20",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.6.158"
},
"1:6.6.28-1+rpt1": {
"linux_commit": "0c341f47adc3578cd5f817aa20ee2b7f9ae6b23e",
"upstream_version": "6.6.28",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.6.158"
},
"1:6.6.31-1+rpt1": {
"linux_commit": "c1432b4bae5b6582f4d32ba381459f33c34d1424",
"upstream_version": "6.6.31",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.6.158"
},
"1:6.6.47-1+rpt1": {
"linux_commit": "cf64a1dfecc2dc418efdd61701c1a4b185ab4761",
"upstream_version": "6.6.47",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.6.158"
},
"1:6.6.51-1+rpt1": {
"linux_commit": "0094eba3f2a4338cfa6854b0b5104d02ba0fa01f",
"upstream_version": "6.6.51",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.6.158"
},
"1:6.6.51-1+rpt2": {
"linux_commit": "82a50e430ef1d6eb37d78e25aa572c1f6ea56160",
"upstream_version": "6.6.51",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.6.158"
},
"1:6.6.51-1+rpt3": {
"linux_commit": "5aeecea9f4a45248bcf564dec924965e066a7bfd",
"upstream_version": "6.6.51",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.6.158"
},
"1:6.6.62-1+rpt1": {
"linux_commit": "dd2394360860d15146c96635796a75b05bb32b61",
"upstream_version": "6.6.62",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.6.158"
},
"1:6.6.74-1+rpt1": {
"linux_commit": "a18d9ced4965462cb7b3b4252ada440395105308",
"upstream_version": "6.6.74",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.6.158"
},
"1:6.12.20-1+rpt1~bpo12+1": {
"linux_commit": "cd231d4775b14f228606c09f219b48308f6ab3aa",
"upstream_version": "6.12.20",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.25-1+rpt1": {
"linux_commit": "3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16",
"upstream_version": "6.12.25",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.34-1+rpt1~bookworm": {
"linux_commit": "8f77e03530f65209a377d25023e912b288e039cd",
"upstream_version": "6.12.34",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.47-1+rpt1~bookworm": {
"linux_commit": "359f37f0faefb712add32a39f98751aea67d5c1f",
"upstream_version": "6.12.47",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.62-1+rpt1~bookworm": {
"linux_commit": "a1073743767f9e7fdc7017ababd2a07ea0c97c1c",
"upstream_version": "6.12.62",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.75-1+rpt1~bookworm": {
"linux_commit": "89050b1059997d38d55462b323b099a6436dc10d",
"upstream_version": "6.12.75",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.87-1+rpt1~bookworm": {
"linux_commit": "ae4d75fb36deba0fe1a986d9bfae65755e082dd0",
"upstream_version": "6.12.87",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.93-1+rpt1": {
"linux_commit": "d8ab4e908235da7727f22dd36ad5af224671677d",
"upstream_version": "6.12.93",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.96-1+rpt1": {
"linux_commit": "ae161617d7a4552fa91d03626b8d9f3696d17481",
"upstream_version": "6.12.96",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.109-1+rpt1": {
"linux_commit": "7d1826930811232688a50c99c540fbb137aed081",
"upstream_version": "6.12.109",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
}
}
}
},
{
"package": {
"ecosystem": "Raspberry Pi OS:13",
"name": "linux"
},
"versions": [
"1:6.12.19-1+rpt1~bpo12+1",
"1:6.12.19-1+rpt1",
"1:6.12.20-1+rpt1",
"1:6.12.25-1+rpt1+trixie",
"1:6.12.34-1+rpt1",
"1:6.12.47-1+rpt1",
"1:6.12.62-1+rpt1",
"1:6.12.75-1+rpt1",
"1:6.18.29-1+rpt1",
"1:6.18.33-1+rpt1",
"1:6.18.34-1+rpt1",
"1:6.18.39-1+rpt1",
"1:6.18.50-1+rpt1"
],
"ecosystem_specific": {
"binaries": [
{
"binary_name": "linux-image-6.12.19+rpt-rpi-2712",
"binary_version": "1:6.12.19-1+rpt1~bpo12+1"
},
{
"binary_name": "linux-image-6.12.19+rpt-rpi-v6",
"binary_version": "1:6.12.19-1+rpt1~bpo12+1"
},
{
"binary_name": "linux-image-6.12.19+rpt-rpi-v7",
"binary_version": "1:6.12.19-1+rpt1~bpo12+1"
},
{
"binary_name": "linux-image-6.12.19+rpt-rpi-v7l",
"binary_version": "1:6.12.19-1+rpt1~bpo12+1"
},
{
"binary_name": "linux-image-6.12.19+rpt-rpi-v8",
"binary_version": "1:6.12.19-1+rpt1~bpo12+1"
},
{
"binary_name": "linux-image-6.12.19+rpt-rpi-2712",
"binary_version": "1:6.12.19-1+rpt1"
},
{
"binary_name": "linux-image-6.12.19+rpt-rpi-v6",
"binary_version": "1:6.12.19-1+rpt1"
},
{
"binary_name": "linux-image-6.12.19+rpt-rpi-v7",
"binary_version": "1:6.12.19-1+rpt1"
},
{
"binary_name": "linux-image-6.12.19+rpt-rpi-v7l",
"binary_version": "1:6.12.19-1+rpt1"
},
{
"binary_name": "linux-image-6.12.19+rpt-rpi-v8",
"binary_version": "1:6.12.19-1+rpt1"
},
{
"binary_name": "linux-image-6.12.20+rpt-rpi-2712",
"binary_version": "1:6.12.20-1+rpt1"
},
{
"binary_name": "linux-image-6.12.20+rpt-rpi-v6",
"binary_version": "1:6.12.20-1+rpt1"
},
{
"binary_name": "linux-image-6.12.20+rpt-rpi-v7",
"binary_version": "1:6.12.20-1+rpt1"
},
{
"binary_name": "linux-image-6.12.20+rpt-rpi-v7l",
"binary_version": "1:6.12.20-1+rpt1"
},
{
"binary_name": "linux-image-6.12.20+rpt-rpi-v8",
"binary_version": "1:6.12.20-1+rpt1"
},
{
"binary_name": "linux-image-6.12.25+rpt-rpi-2712",
"binary_version": "1:6.12.25-1+rpt1+trixie"
},
{
"binary_name": "linux-image-6.12.25+rpt-rpi-v6",
"binary_version": "1:6.12.25-1+rpt1+trixie"
},
{
"binary_name": "linux-image-6.12.25+rpt-rpi-v7",
"binary_version": "1:6.12.25-1+rpt1+trixie"
},
{
"binary_name": "linux-image-6.12.25+rpt-rpi-v8",
"binary_version": "1:6.12.25-1+rpt1+trixie"
},
{
"binary_name": "linux-image-6.12.25+rpt-rpi-v8-rt",
"binary_version": "1:6.12.25-1+rpt1+trixie"
},
{
"binary_name": "linux-image-6.12.34+rpt-rpi-2712",
"binary_version": "1:6.12.34-1+rpt1"
},
{
"binary_name": "linux-image-6.12.34+rpt-rpi-v6",
"binary_version": "1:6.12.34-1+rpt1"
},
{
"binary_name": "linux-image-6.12.34+rpt-rpi-v7",
"binary_version": "1:6.12.34-1+rpt1"
},
{
"binary_name": "linux-image-6.12.34+rpt-rpi-v8",
"binary_version": "1:6.12.34-1+rpt1"
},
{
"binary_name": "linux-image-6.12.34+rpt-rpi-v8-rt",
"binary_version": "1:6.12.34-1+rpt1"
},
{
"binary_name": "linux-image-6.12.47+rpt-rpi-2712",
"binary_version": "1:6.12.47-1+rpt1"
},
{
"binary_name": "linux-image-6.12.47+rpt-rpi-v6",
"binary_version": "1:6.12.47-1+rpt1"
},
{
"binary_name": "linux-image-6.12.47+rpt-rpi-v7",
"binary_version": "1:6.12.47-1+rpt1"
},
{
"binary_name": "linux-image-6.12.47+rpt-rpi-v8",
"binary_version": "1:6.12.47-1+rpt1"
},
{
"binary_name": "linux-image-6.12.47+rpt-rpi-v8-rt",
"binary_version": "1:6.12.47-1+rpt1"
},
{
"binary_name": "linux-image-6.12.62+rpt-rpi-2712",
"binary_version": "1:6.12.62-1+rpt1"
},
{
"binary_name": "linux-image-6.12.62+rpt-rpi-v6",
"binary_version": "1:6.12.62-1+rpt1"
},
{
"binary_name": "linux-image-6.12.62+rpt-rpi-v7",
"binary_version": "1:6.12.62-1+rpt1"
},
{
"binary_name": "linux-image-6.12.62+rpt-rpi-v8",
"binary_version": "1:6.12.62-1+rpt1"
},
{
"binary_name": "linux-image-6.12.62+rpt-rpi-v8-rt",
"binary_version": "1:6.12.62-1+rpt1"
},
{
"binary_name": "linux-image-6.12.75+rpt-rpi-2712",
"binary_version": "1:6.12.75-1+rpt1"
},
{
"binary_name": "linux-image-6.12.75+rpt-rpi-v6",
"binary_version": "1:6.12.75-1+rpt1"
},
{
"binary_name": "linux-image-6.12.75+rpt-rpi-v7",
"binary_version": "1:6.12.75-1+rpt1"
},
{
"binary_name": "linux-image-6.12.75+rpt-rpi-v8",
"binary_version": "1:6.12.75-1+rpt1"
},
{
"binary_name": "linux-image-6.12.75+rpt-rpi-v8-rt",
"binary_version": "1:6.12.75-1+rpt1"
},
{
"binary_name": "linux-image-6.18.29+rpt-rpi-2712",
"binary_version": "1:6.18.29-1+rpt1"
},
{
"binary_name": "linux-image-6.18.29+rpt-rpi-v6",
"binary_version": "1:6.18.29-1+rpt1"
},
{
"binary_name": "linux-image-6.18.29+rpt-rpi-v7",
"binary_version": "1:6.18.29-1+rpt1"
},
{
"binary_name": "linux-image-6.18.29+rpt-rpi-v8",
"binary_version": "1:6.18.29-1+rpt1"
},
{
"binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt",
"binary_version": "1:6.18.29-1+rpt1"
},
{
"binary_name": "linux-image-6.18.33+rpt-rpi-2712",
"binary_version": "1:6.18.33-1+rpt1"
},
{
"binary_name": "linux-image-6.18.33+rpt-rpi-v6",
"binary_version": "1:6.18.33-1+rpt1"
},
{
"binary_name": "linux-image-6.18.33+rpt-rpi-v7",
"binary_version": "1:6.18.33-1+rpt1"
},
{
"binary_name": "linux-image-6.18.33+rpt-rpi-v8",
"binary_version": "1:6.18.33-1+rpt1"
},
{
"binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt",
"binary_version": "1:6.18.33-1+rpt1"
},
{
"binary_name": "linux-image-6.18.34+rpt-rpi-2712",
"binary_version": "1:6.18.34-1+rpt1"
},
{
"binary_name": "linux-image-6.18.34+rpt-rpi-v6",
"binary_version": "1:6.18.34-1+rpt1"
},
{
"binary_name": "linux-image-6.18.34+rpt-rpi-v7",
"binary_version": "1:6.18.34-1+rpt1"
},
{
"binary_name": "linux-image-6.18.34+rpt-rpi-v8",
"binary_version": "1:6.18.34-1+rpt1"
},
{
"binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt",
"binary_version": "1:6.18.34-1+rpt1"
},
{
"binary_name": "linux-image-6.18.39+rpt-rpi-2712",
"binary_version": "1:6.18.39-1+rpt1"
},
{
"binary_name": "linux-image-6.18.39+rpt-rpi-v6",
"binary_version": "1:6.18.39-1+rpt1"
},
{
"binary_name": "linux-image-6.18.39+rpt-rpi-v7",
"binary_version": "1:6.18.39-1+rpt1"
},
{
"binary_name": "linux-image-6.18.39+rpt-rpi-v8",
"binary_version": "1:6.18.39-1+rpt1"
},
{
"binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt",
"binary_version": "1:6.18.39-1+rpt1"
},
{
"binary_name": "linux-image-6.18.50+rpt-rpi-2712",
"binary_version": "1:6.18.50-1+rpt1"
},
{
"binary_name": "linux-image-6.18.50+rpt-rpi-v6",
"binary_version": "1:6.18.50-1+rpt1"
},
{
"binary_name": "linux-image-6.18.50+rpt-rpi-v7",
"binary_version": "1:6.18.50-1+rpt1"
},
{
"binary_name": "linux-image-6.18.50+rpt-rpi-v8",
"binary_version": "1:6.18.50-1+rpt1"
},
{
"binary_name": "linux-image-6.18.50+rpt-rpi-v8-rt",
"binary_version": "1:6.18.50-1+rpt1"
}
]
},
"database_specific": {
"per_version": {
"1:6.12.19-1+rpt1~bpo12+1": {
"linux_commit": "121c2c384b9c2f4790ffb31b2cd25c7d75c8fda0",
"upstream_version": "6.12.19",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.19-1+rpt1": {
"linux_commit": "121c2c384b9c2f4790ffb31b2cd25c7d75c8fda0",
"upstream_version": "6.12.19",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.20-1+rpt1": {
"linux_commit": "cd231d4775b14f228606c09f219b48308f6ab3aa",
"upstream_version": "6.12.20",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.25-1+rpt1+trixie": {
"linux_commit": "3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16",
"upstream_version": "6.12.25",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.34-1+rpt1": {
"linux_commit": "8f77e03530f65209a377d25023e912b288e039cd",
"upstream_version": "6.12.34",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.47-1+rpt1": {
"linux_commit": "359f37f0faefb712add32a39f98751aea67d5c1f",
"upstream_version": "6.12.47",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.62-1+rpt1": {
"linux_commit": "a1073743767f9e7fdc7017ababd2a07ea0c97c1c",
"upstream_version": "6.12.62",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.12.75-1+rpt1": {
"linux_commit": "89050b1059997d38d55462b323b099a6436dc10d",
"upstream_version": "6.12.75",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.12.111"
},
"1:6.18.29-1+rpt1": {
"linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc",
"upstream_version": "6.18.29",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.18.53"
},
"1:6.18.33-1+rpt1": {
"linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412",
"upstream_version": "6.18.33",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.18.53"
},
"1:6.18.34-1+rpt1": {
"linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af",
"upstream_version": "6.18.34",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.18.53"
},
"1:6.18.39-1+rpt1": {
"linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff",
"upstream_version": "6.18.39",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.18.53"
},
"1:6.18.50-1+rpt1": {
"linux_commit": "cff533aec2fa601846766b32ff57204e0a61bed7",
"upstream_version": "6.18.50",
"assessment": "commit ancestry (strak rule)",
"upstream_fixed": "6.18.53"
}
}
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93287"
},
{
"type": "FIX",
"url": "https://git.kernel.org/stable/c/856dffcc097b3d8ed45a643ebda07cb92968cb33"
},
{
"type": "FIX",
"url": "https://git.kernel.org/stable/c/356875e33f2c6d2061a02c9dec1a1e639d265a55"
},
{
"type": "FIX",
"url": "https://git.kernel.org/stable/c/72ca5e0b8b7a62615758f8871c34d61616c2dc8b"
},
{
"type": "FIX",
"url": "https://git.kernel.org/stable/c/df077253f6405d67ad087538e495ef32a05717b7"
},
{
"type": "FIX",
"url": "https://git.kernel.org/stable/c/f09edffba97d37b1fdff5f818a9a45f8a98ac171"
},
{
"type": "FIX",
"url": "https://git.kernel.org/stable/c/c4b478bc50b7ca9865e237909941253a0f7111a2"
},
{
"type": "FIX",
"url": "https://git.kernel.org/stable/c/3051cd060fa496df42954291fa2306ed2eab4ecc"
}
],
"database_specific": {
"source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
"upstream_modified": "2026-10-03T11:04:09Z",
"severity": {
"source": "kernel CNA",
"cvss_v3_score": 7.8,
"cvss_v3_severity": "High",
"scenario": "AV:L - Attacker-controlled data is data->block[0] copied from the I2C_SMBUS ioctl in i2cdev_ioctl_smbus() (i2cdev_ioctl \u2192 i2cdev_ioctl_smbus \u2192 i2c_smbus_xfer \u2192 __i2c_smbus_xfer). That byte is supplied by the local process, not by a network protocol or a remote I2C slave.\nAC:L - A single I2C_SMBUS ioctl with attacker-chosen block[0] (e.g. 0xfe) is consumed in __i2c_smbus_xfer() before any length check, so trace_smbus_write() memcpy()s block[0]+1 bytes and native callbacks such as stub_xfer() index block[1+i] with that length. There is no race or uninfluenced hardware failure.\nPR:L - i2cdev_open() and i2cdev_ioctl() contain no capable() check; I2C_SMBUS is allowed to whoever can open /dev/i2c-N. That node is commonly 0660 group i2c (i2c-tools udev), so an unprivileged i2c-group user reaches i2cdev_ioctl_smbus() without root or a user-namespace capability.\nUI:N - The attacker opens /dev/i2c-N and issues the I2C_SMBUS ioctl with a crafted i2c_smbus_ioctl_data themselves; no separate victim action is required.\nS:U - Overflows land in the host kernel's i2cdev_ioctl_smbus() stack union and in the smbus_write trace-event buffer handled by that same kernel. This is ordinary local kernel memory corruption, not a VM, IOMMU, or sandbox-authority crossing.\nC:H - With block[0]=0xfe, trace_smbus_write() memcpy()s 255 bytes from the 34-byte union i2c_smbus_data temp on i2cdev_ioctl_smbus()'s stack, disclosing 221 bytes of adjacent kernel stack. stub_xfer() I2C_SMBUS_I2C_BLOCK_DATA writes likewise read block[1+i] past that union.\nI:H - The same memcpy writes 255 bytes into smbus_write's 34-byte __entry->buf, overflowing the ftrace event by 221 bytes. stub_xfer() I2C_SMBUS_I2C_BLOCK_DATA reads write past temp.block[33] on i2cdev_ioctl_smbus()'s kernel stack, a stack overflow that can corrupt return state.\nA:H - The 221-byte out-of-bounds read/write in trace_event_raw_event_smbus_write() and the stub_xfer() store past union i2c_smbus_data.block[33] produce a kernel oops/panic, matching the KASAN and UBSAN reports cited in the fix."
}
}
}