vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-50394

i2c: ismt: Fix an out-of-bounds bug in ismt_access()

HIGH
7.1
CVSS Score
Published: September 18, 2025 at 01:33 PM UTC
Updated: August 5, 2026 at 09:24 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.1
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: ismt: Fix an out-of-bounds bug in ismt_access() When the driver does not check the data from the user, the variable 'data->block[0]' may be very large to cause an out-of-bounds bug. The following log can reveal it: [ 33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20 [ 33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA: WRITE [ 33.996475] ================================================================== [ 33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b [ 33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485 [ 33.999450] Call Trace: [ 34.001849] memcpy+0x20/0x60 [ 34.002077] ismt_access.cold+0x374/0x214b [ 34.003382] __i2c_smbus_xfer+0x44f/0xfb0 [ 34.004007] i2c_smbus_xfer+0x10a/0x390 [ 34.004291] i2cdev_ioctl_smbus+0x2c8/0x710 [ 34.005196] i2cdev_ioctl+0x5ec/0x74c Fix this bug by checking the size of 'data->block[0]' first.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
3.9 ≤ v < 4.14.3033.9 ≤ v < 4.19.2703.9 ≤ v < 4.9.3373.9 ≤ v < 5.10.1633.9 ≤ v < 5.15.863.9 ≤ v < 5.4.2293.9 ≤ v < 6.0.163.9 ≤ v < 6.1.23.9 ≤ v < 6.24.10 ≤ v < 4.14.3034.15 ≤ v < 4.19.2704.20 ≤ v < 5.4.2295.11 ≤ v < 5.15.865.16 ≤ v < 6.0.165.5 ≤ v < 5.10.1636.1 ≤ v < 6.1.213f35ac14cd0a9a1c4f0034c4c40d0ae98844ce93.9
Vendor states this is fixed in 03b7ef7a6c5ca1ff553470166b4919db88b810f6 (fixed)
Vendor states this is fixed in 233348a04becf133283f0076e20b317302de21d9 (fixed)
Vendor states this is fixed in 39244cc754829bf707dccd12e2ce37510f5b1f8d (fixed)
Vendor states this is fixed in 4a7bb1d93addb2f67e36fed00a53cb7f270d7b7a (fixed)
Vendor states this is fixed in 96c12fd0ec74641295e1c3c34dea3dce1b6c3422 (fixed)
Vendor states this is fixed in 9ac541a0898e8ec187a3fa7024b9701cffae6bf2 (fixed)
Vendor states this is fixed in a642469d464b2780a25a49b51ae56623c65eac34 (fixed)
Vendor states this is fixed in bfe41d966c860a8ad4c735639d616da270c92735 (fixed)
Vendor states this is fixed in cdcbae2c5003747ddfd14e29db9c1d5d7e7c44dd (fixed)
Vendor states this is fixed in 3.9 (unaffected)
Vendor states this is fixed in 4.14.303 (unaffected)
Vendor states this is fixed in 4.19.270 (unaffected)
Vendor states this is fixed in 4.9.337 (unaffected)
Vendor states this is fixed in 5.10.163 (unaffected)
Vendor states this is fixed in 5.15.86 (unaffected)
Vendor states this is fixed in 5.4.229 (unaffected)
Vendor states this is fixed in 6.0.16 (unaffected)
Vendor states this is fixed in 6.1.2 (unaffected)
Vendor states this is fixed in 6.2 (unaffected)

References (9)

Patch
Source: cverecord
https://git.kernel.org/stable/c/4a7bb1d93addb2f67e36fed00a53cb7f270d7b7a
Patch
Source: cverecord
https://git.kernel.org/stable/c/03b7ef7a6c5ca1ff553470166b4919db88b810f6
Patch
Source: cverecord
https://git.kernel.org/stable/c/bfe41d966c860a8ad4c735639d616da270c92735
Patch
Source: cverecord
https://git.kernel.org/stable/c/cdcbae2c5003747ddfd14e29db9c1d5d7e7c44dd
Patch
Source: cverecord
https://git.kernel.org/stable/c/9ac541a0898e8ec187a3fa7024b9701cffae6bf2
Patch
Source: cverecord
https://git.kernel.org/stable/c/96c12fd0ec74641295e1c3c34dea3dce1b6c3422
Patch
Source: cverecord
https://git.kernel.org/stable/c/a642469d464b2780a25a49b51ae56623c65eac34
Patch
Source: cverecord
https://git.kernel.org/stable/c/233348a04becf133283f0076e20b317302de21d9

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.1HIGHCISA-ADP
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-125

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card