In the Linux kernel, the following vulnerability has been resolved:

Input: rmi smbus - fix out-of-bounds read in rmi smb write block()

When chunking writes into SMBus blocks in rmi smb write block(), the loop calculates block len using the original total length (len) instead of the remaining length (cur len).

If len is greater than 32 bytes (SMB MAX COUNT), block len remains 32 for every iteration, even on the final partial chunk where fewer than 32 bytes remain. This causes smb block write() to read 32 bytes from the advanced data buffer pointer, reading past the end of the input buffer.

Fix this by calculating block len using cur len and advancing the buffer and address pointers by block len.