CVE-2022-50394: i2c: ismt: Fix an out-of-bounds bug in ismt_access()

Published Sep 18, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

i2c: ismt: Fix an out-of-bounds bug in ismtaccess()

When the driver does not check the data from the user, the variable 'data->block[0]' may be very large to cause an out-of-bounds bug.

The following log can reveal it:

[ 33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20 [ 33.995978] ismtsmbus 0000:00:05.0: I2CSMBUSBLOCKDATA: WRITE [ 33.996475] ================================================================== [ 33.996995] BUG: KASAN: out-of-bounds in ismtaccess.cold+0x374/0x214b [ 33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismtpoc/485 [ 33.999450] Call Trace: [ 34.001849] memcpy+0x20/0x60 [ 34.002077] ismtaccess.cold+0x374/0x214b [ 34.003382] i2csmbusxfer+0x44f/0xfb0 [ 34.004007] i2csmbusxfer+0x10a/0x390 [ 34.004291] i2cdevioctlsmbus+0x2c8/0x710 [ 34.005196] i2cdevioctl+0x5ec/0x74c

Fix this bug by checking the size of 'data->block[0]' first.

Affected Software

9 affected components

Linux Linux kernel

Linux Linux kernel>=3.9<4.9.337

Linux Linux kernel>=4.10<4.14.303

Linux Linux kernel>=4.15<4.19.270

Linux Linux kernel>=4.20<5.4.229

Linux Linux kernel>=5.5<5.10.163

Linux Linux kernel>=5.11<5.15.86

Linux Linux kernel>=5.16<6.0.16

Linux Linux kernel>=6.1<6.1.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
In ismt_access(), check the size/length of 'data->block[0]' from the user before performing memcpy/copy operations that could access beyond the buffer.
Linux kernel driver (i2c: ismt / ismt_access.c) Validate size of user-provided data->block[0] before use = Add a bounds/size check for 'data->block[0]' prior to copying/accessing it (prevent out-of-bounds)

Event History

Sep 18, 2025

CVE Published

via MITRE·01:33 PM

Data Sourced

via MITRE·01:33 PM

DescriptionSeverity

Data Sourced

via NVD·02:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-50394?

CVE-2022-50394 is rated as a medium severity vulnerability due to its potential to cause out-of-bounds access.

How do I fix CVE-2022-50394?

To fix CVE-2022-50394, ensure you update the Linux kernel to the latest version that has patched this vulnerability.

What systems are affected by CVE-2022-50394?

CVE-2022-50394 affects the Linux kernel versions prior to the applicable patches addressing the out-of-bounds bug.

What can happen if CVE-2022-50394 is exploited?

If exploited, CVE-2022-50394 could lead to unexpected behavior or possible memory corruption due to out-of-bounds access.

When was CVE-2022-50394 discovered?

CVE-2022-50394 was publicly disclosed in 2022, highlighting a bug within the Linux kernel regarding user data validation.