{"id":21264,"date":"2026-09-12T04:30:57","date_gmt":"2026-09-11T20:30:57","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80931"},"modified":"2026-09-12T04:30:57","modified_gmt":"2026-09-11T20:30:57","slug":"cve-2026-80931","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80931","title":{"rendered":"CVE-2026-80931 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nw1: ds28e17: reject a"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>w1: ds28e17: reject an oversize length on an I2C block read<\/p>\n<p>w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire<br \/>\nto I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the<br \/>\ndevice. The downstream slave puts a length byte in buf[0]. The driver<br \/>\nthen reads that many bytes into buf[1] with w1_f19_i2c_read().<\/p>\n<p>buf[0] is controlled by the device and can be 0 to 255.<br \/>\nw1_f19_i2c_read() only rejects a zero count. The caller buffer is<br \/>\nI2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read<br \/>\nrun past it, up to about 222 bytes out of bounds.<\/p>\n<p>The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That<br \/>\ncheck runs after master_xfer returns. By then the write is already<br \/>\ndone. i2c-algo-bit rejects an oversize length before it copies, and<br \/>\nreturns -EPROTO.<\/p>\n<p>Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the<br \/>\nsame way i2c-algo-bit does.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>w1: ds28e17: reject an oversize length on an I2C block read<\/p>\n<p>w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21264","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21264","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21264"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21264"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21264"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}