CVE-2026-80931
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, w1_f19_i2c_master_transfer(), the master_xfer for the DS28E17 1-Wire to I2C bridge, takes the length from the device on an I2C_M_RECV_LEN read. The driver reads that many bytes into buf[1], but the caller buffer is I2C_SMBUS_BLOCK_MAX + 2 (34 bytes), so a length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core check runs after master_xfer returns, by which time the write is already done.
Risk Assessment
An out-of-bounds read may lead to kernel data disclosure or system crash. It requires a controlled I2C device connected via the DS28E17 bridge.
Recommendation
Update the Linux kernel to a version with the fix that rejects a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, as i2c-algo-bit does.
Related vulnerabilities
- CVE-2026-63190Critical
Prior to version 0.1.4, FearlessCMS contains five debug/test PHP scripts under admin/ that perform privileged operations without authentication, CSRF protection, or adequate path validation. On PHP's built-in server (including the default Docker deployment), the /./admin/ path bypasses the login gate, enabling arbitrary .md writes, directory enumeration, stored/reflected XSS, and disk exhaustion.
- CVE-2026-117574Critical
In ai-gateway-payload-processing, an authenticated remote attacker can specify another tenant's model identifier in the request body or header. The service does not verify authorization before retrieving credentials from the shared store, so it injects the target tenant's API keys into the request.
- CVE-2026-118264Critical
In the Echo Go web framework from 4.0.0 until 4.16.1 and in 5.4.1, the Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream, bypassing Echo's router and route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes.
- CVE-2026-103409Critical
A missing authentication for a critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. The vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor; it can no longer be exploited once the device is onboarded.
- CVE-2026-103406Critical
An improper neutralization of special elements used in an OS command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
- CVE-2026-44179Critical
The `excerpt-include` macro in XWiki Remote Macros does not properly escape the included page's title and executes `excerpt` content with the macro's rights. Both the title handling and the rendering of `excerpt` content into XWiki syntax allow syntax injection. Any user able to edit a page, even without script rights, can supply executable macro syntax and cause remote code execution when the page is included.
- CVE-2026-115968Critical
A deserialization of untrusted data vulnerability in the Ultimate Member WordPress plugin allows Object Injection. Affects versions up to and including 2.13.1.
- CVE-2026-105420Critical
Wing FTP Server does not verify the user's base folder, allowing an attacker with admin privileges to add user directories via scripts that escape the base folder. This enables file writes on the system and potential remote code execution with process owner privileges, and with sudo-based installation files are created as root. Fixed in version 8.2.6.
- CVE-2026-67074Critical
HCL BigFix AEX is affected by a Remote Code Execution (RCE) vulnerability. An attacker may execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.
- CVE-2026-115904Critical
Topluyo Desktop for Linux prior to version 2026.9.2410 unsafely processes user-controlled URLs, leading to OS Command Injection via the openExternalLinks() routine in utils.js. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the device. The downstream slave puts a length byte in buf[0]. The driver then reads that many bytes into buf[1] with w1_f19_i2c_read(). buf[0] is controlled by the device and can be 0 to 255. w1_f19_i2c_read() only rejects a zero count. The caller buffer is I2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That check runs after master_xfer returns. By then the write is already done. i2c-algo-bit rejects an oversize length before it copies, and returns -EPROTO. Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the same way i2c-algo-bit does.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS