CVE-2026-52948 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should be aware of this vulnerability. A local attacker with sufficient privileges could exploit this vulnerability to cause a Denial of Service (DoS).

Technical summary

The I2C_TIMEOUT ioctl in the Linux kernel accepts a user-provided timeout in multiples of 10 ms. However, the user argument is checked against INT_MAX, but subsequently multiplied by 10 before being passed to msecs_to_jiffies(). A malicious user can pass a large value (e.g., 429496729) that passes the `arg > INT_MAX` check but overflows when multiplied by 10. This results in a truncated 32-bit unsigned value that bypasses the internal `(int)m < 0` check in `msecs_to_jiffies()`. The truncated value is then assigned to `client->adapter->timeout` (a signed 32-bit int), which is reinterpreted as a negative number. When passed to wait_for_completion_timeout(), this negative value undergoes sign extension to a 64-bit unsigned long, triggering the `schedule_timeout` warning and causing premature returns.

Defensive priority

High priority should be given to patching this vulnerability, as a local attacker with sufficient privileges could exploit it to cause a Denial of Service (DoS).

Recommended defensive actions

• Apply the official patch from the Linux kernel maintainers.
• Review and update Linux kernel configurations to ensure that I2C_TIMEOUT ioctl is properly bounded.
• Monitor system logs for schedule_timeout warnings and investigate any potential DoS attempts.
• Consider implementing additional security controls, such as SELinux or AppArmor, to limit the impact of a potential exploit.
• Perform regular vulnerability scans and updates to ensure that the system is up-to-date with the latest security patches.

Evidence notes

The CVE record and NVD detail pages provide information on this vulnerability. The Linux kernel maintainers have released official patches to address this issue. Additional information can be found in the referenced commits from the Linux kernel repository.

Official resources