PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64191 Linux CVE debrief

A local user with access to /dev/i2c-* can exploit CVE-2026-64191, a HIGH severity vulnerability in the Linux kernel I2C stub, to cause a stack-out-of-bounds read or write. The bug exists because i2c-stub implements .smbus_xfer directly, bypassing I2C_SMBUS_BLOCK_MAX validation. This vulnerability can be mitigated by rejecting transfers with invalid length. Users running Linux kernel with I2C stub enabled should apply patches to prevent local exploitation.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-08-11
Advisory published
2026-07-20
Advisory updated
2026-08-11

Who should care

Users running Linux kernel with I2C stub enabled should apply patches to prevent local exploitation. Developers loading i2c-stub module with chip_addr= parameter are at risk. System administrators and security teams should review system logs for suspicious I2C_SMBUS ioctl activity and consider restricting access to /dev/i2c-* to trusted users.

Technical summary

The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length, but only clamps it to avoid overrunning chip->words[256]. It does not validate against I2C_SMBUS_BLOCK_MAX (32). A local user can issue an I2C_SMBUS ioctl with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing stub_xfer() to access beyond the union i2c_smbus_data.block buffer. The fix involves rejecting transfers with data->block[0] == 0 or data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL.

Defensive priority

Apply patches immediately. Restrict access to /dev/i2c-* to trusted users. Monitor for suspicious I2C_SMBUS ioctl activity and review system logs.

Recommended defensive actions

  • Apply patches to update Linux kernel I2C stub
  • Restrict access to /dev/i2c-* to trusted users
  • Monitor system logs for suspicious I2C_SMBUS ioctl activity
  • Inventory Linux systems for I2C stub usage
  • Consider disabling I2C stub if not required
  • Review compensating controls for exposed systems
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-07-20T17:18:22.217Z and has been modified on 2026-07-27T05:16:35.123Z. Multiple source references are provided, including kernel.org stable commits. The I2C stub vulnerability allows local users to cause a stack-out-of-bounds read or write. Evidence is limited to public sources and may not reflect the full scope of affected systems. Defenders should verify system logs for suspicious I2C_SMBUS ioctl activity and review compensating controls.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64191 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64191

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64191 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64191

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0526931b16e5a118d367b7bfce7d797e63f7ac69

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1c4ffe6b4f04365485ed58d64c9bb86b46fc9037

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/21e87f336ac6303fed54a69b1d0d79a23b25c8d0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3fd225f3e4cd67ec8ddab1afed9da03c7c43537c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4bd8635f28c135a08aac6badcd7d9b5cdb34335f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5f4d2bd028ebb6e4c09a9d64842546022321d4a7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.