Answer in brief
CVE-2026-80931 records a High severity (CVSS 7.8) vulnerability in w1: ds28e17: reject an oversize length on an I2C block read. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <cb55c5da9828f77db2a2701316949d4de1e9b773 || >=ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <ae0c79a8527044e54d81fd5a3b49ce6177633758 || >=ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <6df05f630c84a109736642362e452089886f9974 || >=ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <169ae5e65e5aaf213b6a578f6478a9fd2e523606 | cb55c5da9828f77db2a2701316949d4de1e9b773, ae0c79a8527044e54d81fd5a3b49ce6177633758, 6df05f630c84a109736642362e452089886f9974, 169ae5e65e5aaf213b6a578f6478a9fd2e523606 |
| Linux/Linuxgeneric | 4.15 | Not reported |
| Linux/Linuxgeneric | >=ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <b30c021c6073559ea6851b522d8a17a524a27b4a || >=ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <1d08877fc37e90945df38d255715bd1d6c052d46 || >=ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <bf76d61e118b7044600a65775a3bf8adc2c6823d || >=ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <0f6496b34cc2919420f303b2aabdd9f71e084b56 || >=ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <cb55c5da9828f77db2a2701316949d4de1e9b773 || >=ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <ae0c79a8527044e54d81fd5a3b49ce6177633758 || >=ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <6df05f630c84a109736642362e452089886f9974 || >=ebc4768ac4971eab4b570e733e47ac9dfd0e4175 <169ae5e65e5aaf213b6a578f6478a9fd2e523606 | b30c021c6073559ea6851b522d8a17a524a27b4a, 1d08877fc37e90945df38d255715bd1d6c052d46, bf76d61e118b7044600a65775a3bf8adc2c6823d, 0f6496b34cc2919420f303b2aabdd9f71e084b56, cb55c5da9828f77db2a2701316949d4de1e9b773, ae0c79a8527044e54d81fd5a3b49ce6177633758, 6df05f630c84a109736642362e452089886f9974, 169ae5e65e5aaf213b6a578f6478a9fd2e523606 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the device. The downstream slave puts a length byte in buf[0]. The driver then reads that many bytes into buf[1] with w1_f19_i2c_read(). buf[0] is controlled by the device and can be 0 to 255. w1_f19_i2c_read() only rejects a zero count. The caller buffer is I2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That check runs after master_xfer returns. By then the write is already done. i2c-algo-bit rejects an oversize length before it copies, and returns -EPROTO. Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the same way i2c-algo-bit does.
Quoted source text, attributed separately from HOL analysis.