CVE-2026-52948: i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
In the Linux kernel, the following vulnerability has been resolved:
i2c: dev: prevent integer overflow in I2CTIMEOUT ioctl
While fuzzing with Syzkaller, a persistent scheduletimeout: wrong timeout value warning was observed, accompanied by SMBus controller state machine corruption.
The I2CTIMEOUT ioctl accepts a user-provided timeout in multiples of 10 ms. The user argument is checked against INTMAX, but it is subsequently multiplied by 10 before being passed to msecstojiffies().
A malicious user can pass a large value (e.g., 429496729) that passes the arg > INTMAX check but overflows when multiplied by 10. This results in a truncated 32-bit unsigned value that bypasses the internal (int)m < 0 check in msecstojiffies().
The truncated value is then assigned to client->adapter->timeout (a signed 32-bit int), which is reinterpreted as a negative number. When passed to waitforcompletiontimeout(), this negative value undergoes sign extension to a 64-bit unsigned long, triggering the scheduletimeout warning and causing premature returns. This leaves the SMBus state machine in an unrecoverable state, constituting a local Denial of Service (DoS).
Fix this by bounding the user argument to INTMAX / 10.
[wsa: move the comment as well]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the I2C_TIMEOUT ioctl path, bound the user-provided timeout argument to `INT_MAX / 10` (so the subsequent multiplication by 10 cannot overflow and turn into a negative value when passed to `msecs_to_jiffies()` / `wait_for_completion_timeout()`).
Linux kernel I2C_TIMEOUT ioctl timeout argument handling (bounding check before multiplying by 10) = Bound user-provided timeout to INT_MAX / 10 before multiplying by 10 (i.e., ensure arg * 10 <= INT_MAX).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52948?
The severity of CVE-2026-52948 is rated as 22.
How do I fix CVE-2026-52948?
To fix CVE-2026-52948, update your Linux kernel to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-52948?
CVE-2026-52948 affects the Linux i2c-dev subsystem in the Linux kernel.
What type of vulnerability is CVE-2026-52948?
CVE-2026-52948 is classified as an integer overflow vulnerability.
What consequences can occur from CVE-2026-52948?
CVE-2026-52948 may result in SMBus controller state machine corruption and erroneous timeout behaviors.