CVE-2026-80931

The Linux kernel's DS28E17 1-Wire-to-I2C bridge driver (w1_f19 / ds28e17) fails to validate a length byte supplied by the remote I2C slave device during SMBus-style block reads using I2C_M_RECV_LEN. Because the caller's buffer is only 34 bytes while the attacker-controlled length can be up to 255, a malicious I2C peripheral can make the kernel write up to roughly 222 bytes past the end of the buffer; the SMBus core's length check runs only after master_xfer returns, too late to prevent the corruption. Successful exploitation yields kernel memory corruption with potential privilege escalation or a crash, but it requires the attacker to control or compromise the physical I2C slave device attached to the DS28E17 bridge, making this effectively an attack from hostile hardware on the bus. Affected systems are Linux machines whose kernel ships the ds28e17 driver and that actually have a DS28E17 bridge in use. No public proof-of-concept exists and no exploitation is known in the wild; the fix rejects any received length above I2C_SMBUS_BLOCK_MAX (32), matching the behavior already used by i2c-algo-bit.

What to do: Update to a kernel release from your distribution that carries the upstream fix once available. Determine whether you are exposed by checking if the ds28e17/w1_f19 driver is loaded (e.g., lsmod | grep w1) and whether any DS28E17 bridges are attached; if the hardware is unused, blacklist the module. Treat only physically trusted I2C peripherals as safe to connect behind a DS28E17 bridge, since exploitation requires a malicious slave device.