Vulnerability-Lookup

GHSA-QR79-P6WG-4P8Q

Vulnerability from github – Published: 2025-09-05 18:31 – Updated: 2025-11-25 21:32

Details

In the Linux kernel, the following vulnerability has been resolved:

i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer

The data->block[0] variable comes from user. Without proper check, the variable may be very large to cause an out-of-bounds bug.

Fix this bug by checking the value of data->block[0] first.

commit 39244cc75482 ("i2c: ismt: Fix an out-of-bounds bug in ismt_access()")
commit 92fbb6d1296f ("i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()")

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-39680"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-05T18:15:44Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer\n\nThe data-\u003eblock[0] variable comes from user. Without proper check,\nthe variable may be very large to cause an out-of-bounds bug.\n\nFix this bug by checking the value of data-\u003eblock[0] first.\n\n1. commit 39244cc75482 (\"i2c: ismt: Fix an out-of-bounds bug in\n   ismt_access()\")\n2. commit 92fbb6d1296f (\"i2c: xgene-slimpro: Fix out-of-bounds bug in\n   xgene_slimpro_i2c_xfer()\")",
  "id": "GHSA-qr79-p6wg-4p8q",
  "modified": "2025-11-25T21:32:03Z",
  "published": "2025-09-05T18:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39680"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/071e43fcba5ddd9a7813e6cc0aa10299eae41b21"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/57f312b955938fc4663f430cb57a71f2414f601b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-39680 (GCVE-0-2025-39680)

Vulnerability from cvelistv5 – Published: 2025-09-05 17:20 – Updated: 2026-08-05 12:04

Title

i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer

Summary

In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer The data->block[0] variable comes from user. Without proper check, the variable may be very large to cause an out-of-bounds bug. Fix this bug by checking the value of data->block[0] first. 1. commit 39244cc75482 ("i2c: ismt: Fix an out-of-bounds bug in ismt_access()") 2. commit 92fbb6d1296f ("i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()")

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/071e43fcba5ddd9a7…
https://git.kernel.org/stable/c/57f312b955938fc46…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c366be720235301fdadf67e6f1ea6ff32669c074 , < 071e43fcba5ddd9a7813e6cc0aa10299eae41b21 (git) Affected: c366be720235301fdadf67e6f1ea6ff32669c074 , < 57f312b955938fc4663f430cb57a71f2414f601b (git)
Linux	Linux	Affected: 6.13 Unaffected: 0 , < 6.13 (semver) Unaffected: 6.16.4 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-rtl9300.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "071e43fcba5ddd9a7813e6cc0aa10299eae41b21",
              "status": "affected",
              "version": "c366be720235301fdadf67e6f1ea6ff32669c074",
              "versionType": "git"
            },
            {
              "lessThan": "57f312b955938fc4663f430cb57a71f2414f601b",
              "status": "affected",
              "version": "c366be720235301fdadf67e6f1ea6ff32669c074",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-rtl9300.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer\n\nThe data-\u003eblock[0] variable comes from user. Without proper check,\nthe variable may be very large to cause an out-of-bounds bug.\n\nFix this bug by checking the value of data-\u003eblock[0] first.\n\n1. commit 39244cc75482 (\"i2c: ismt: Fix an out-of-bounds bug in\n   ismt_access()\")\n2. commit 92fbb6d1296f (\"i2c: xgene-slimpro: Fix out-of-bounds bug in\n   xgene_slimpro_i2c_xfer()\")"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through the `I2C_SMBUS` ioctl on a local `/dev/i2c-N` character device (`i2cdev_ioctl_smbus` \u2192 `i2c_smbus_xfer` \u2192 `rtl9300_i2c_smbus_xfer`). There is no network or remote-peer path into this driver.\nAC:L - A single ioctl with an attacker-chosen `data-\u003eblock[0]` deterministically drives the unvalidated length into `rtl9300_i2c_config_xfer()` and the transfer helpers; there is no race, timing window, or memory-layout condition outside the attacker\u0027s control.\nPR:L - `i2cdev_open()` and `i2cdev_ioctl()` contain no `capable()`/`CAP_*` check whatsoever \u2014 reachability depends purely on `/dev/i2c-*` node permissions, which embedded, switch, and Android-style images commonly grant to a non-root `i2c` group. Matches the PR:L used for the analogous CVE-2026-64191 and CVE-2026-31627.\nUI:N - The attacker triggers the flaw entirely on their own with one ioctl on an already-present device node; no victim action, mount, or file-open is needed.\nS:U - The unvalidated length is consumed within the kernel\u0027s own memory and the SoC\u0027s I\u00b2C controller registers, all under the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked user-supplied length propagates to out-of-bounds reads past the 34-byte `union i2c_smbus_data` on the caller\u0027s stack (via `trace_smbus_write()` on the shared path, and via `i2c_smbus_read_block_data()`\u0027s `memcpy` of the driver-overwritten `block[0]`), exposing adjacent kernel stack contents.\nI:H - The same value reaches an out-of-bounds write context \u2014 `i2c_smbus_read_block_data()` copies a length of up to 255 into a 32-byte caller buffer \u2014 and the `(len - 1) \u0026 0xf` underflow programs unintended hardware writes, which the same-driver CVE-2025-39928 documents as destructive (overwriting SFP EEPROM contents).\nA:H - Out-of-bounds stack access of this kind produces oopses/panics under KASAN or on corrupted stack state, and the spurious 16-byte hardware transfer can permanently brick attached I\u00b2C peripherals, denying service to the device."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:30.326Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/071e43fcba5ddd9a7813e6cc0aa10299eae41b21"
        },
        {
          "url": "https://git.kernel.org/stable/c/57f312b955938fc4663f430cb57a71f2414f601b"
        }
      ],
      "title": "i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39680",
    "datePublished": "2025-09-05T17:20:46.456Z",
    "dateReserved": "2025-04-16T07:20:57.112Z",
    "dateUpdated": "2026-08-05T12:04:30.326Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.