CVE-2026-14986: Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction

The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIGI2CTARGET + CONFIGI2CTARGETBUFFERMODE), copies host-supplied write data into the fixed-size data->targetinbuffer inside its target FIFO interrupt handler targeti2cisrfifo() in drivers/i2c/i2citeit51xxx.c. The copy loop stores to targetinbuffer[i + data->windex] and only checks data->windex against sizeof(data->targetinbuffer) after the write has already completed, so the bounds check cannot prevent the overflow.

The running index data->windex accumulates count bytes on every FIFO-fill interrupt of an ongoing transaction and is reset to zero only on a STOP or timeout condition. An I2C host that streams a single write transaction longer than the buffer (default CONFIGI2CTARGETIT51XXXMAXBUFSIZE = 256 bytes) drives data->windex past the end of the buffer, and each subsequent host byte is written out of bounds into the adjacent data->targetoutbuffer and following static device data.

The trigger is a malicious or misbehaving I2C master on the same bus (for example a compromised application processor or a rogue device on an exposed I2C bus); no software privilege on the victim is required and the handler runs in the target's kernel/firmware context. Because both the written values and the overflow length are attacker-controlled, this is an out-of-bounds write that can crash the controller or be shaped toward code execution. The fix adds a pre-write bounds check in targeti2cfiforeadtobuf() that aborts and resets the FIFO before any out-of-bounds store.