CVE-2025-39928: i2c: rtl9300: ensure data length is within supported range
In the Linux kernel, the following vulnerability has been resolved:
i2c: rtl9300: ensure data length is within supported range
Add an explicit check for the xfer length to 'rtl9300i2cconfigxfer' to ensure the data length isn't within the supported range. In particular a data length of 0 is not supported by the hardware and causes unintended or destructive behaviour.
This limitation becomes obvious when looking at the register documentation [1]. 4 bits are reserved for DATAWIDTH and the value of these 4 bits is used as N + 1, allowing a data length range of 1 <= len <= 16.
Affected by this is the SMBus Quick Operation which works with a data length of 0. Passing 0 as the length causes an underflow of the value due to:
(len - 1) & 0xf
and effectively specifying a transfer length of 16 via the registers. This causes a 16-byte write operation instead of a Quick Write. For example, on SFP modules without write-protected EEPROM this soft-bricks them by overwriting some initial bytes.
For completeness, also add a quirk for the zero length.
[1] https://svanheule.net/realtek/longan/register/i2cmst1ctrl2
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In rtl9300_i2c_config_xfer, add an explicit check that the xfer length is within the supported range for the DATA_WIDTH-encoded length (where 4 bits encode N+1). Specifically ensure length=0 is treated as a zero-length quirk and is not allowed to underflow into an unintended 16-byte write.
Linux kernel i2c: rtl9300 (rtl9300_i2c_config_xfer) xfer length validation = Reject/guard length=0 and ensure transfer length is within supported range encoded by the DATA_WIDTH field (4 bits used as N+1)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39928?
CVE-2025-39928 has been classified with a moderate severity due to potential out-of-bounds access risks.
How do I fix CVE-2025-39928?
To fix CVE-2025-39928, update the Linux kernel to the latest version that includes the patch for this vulnerability.
What does CVE-2025-39928 affect?
CVE-2025-39928 affects the Linux kernel, specifically the i2c subsystem related to rtl9300 devices.
Is CVE-2025-39928 a remote vulnerability?
CVE-2025-39928 is not classified as a remote vulnerability, but it may be exploited locally under certain conditions.
When was CVE-2025-39928 discovered?
CVE-2025-39928 was resolved in recent updates to the Linux kernel, though the exact discovery date is not specified.