CVE-2026-80931
CVE CVE-2026-80931EUVD EUVD-2026-76254Published 2026-09-11T19:42:06.000ZLast changed 2026-09-14T11:58:57.000ZCVSS 7.8
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the device. The downstream slave puts a length byte in buf[0]. The driver then reads that many bytes into buf[1] with w1_f19_i2c_read(). buf[0] is controlled by the device and can be 0 to 255. w1_f19_i2c_read() only rejects a zero count. The caller buffer is I2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That check runs after master_xfer returns. By then the write is already done. i2c-algo-bit rejects an oversize length before it copies, and returns -EPROTO. Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the same way i2c-algo-bit does.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux 4.15; patch: 5.15.221; ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <0f6496b34cc2919420f303b2aabdd9f71e084b56; patch: 6.12.109; ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <1d08877fc37e90945df38d255715bd1d6c052d46; patch: 7.2.4; ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <6df05f630c84a109736642362e452089886f9974; patch: 6.6.157; ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <bf76d61e118b7044600a65775a3bf8adc2c6823d; patch: 6.1.188; patch: 0; patch: 6.18.50; patch: 5.10.270; ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <cb55c5da9828f77db2a2701316949d4de1e9b773; patch: 7.3-rc1; ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <ae0c79a8527044e54d81fd5a3b49ce6177633758; ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <b30c021c6073559ea6851b522d8a17a524a27b4a; ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <169ae5e65e5aaf213b6a578f6478a9fd2e523606
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.