CVE-2026-52948

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer overflow exists in the I2C TIMEOUT ioctl. The function accepts a user-provided timeout value in multiples of 10 ms. Although the argument is checked against INT MAX, it is subsequently multiplied by 10 before being passed to the msecs to jiffies() function. A malicious user can provide a large value that bypasses the initial check but overflows during multiplication, resulting in a truncated 32-bit unsigned value. This value is then assigned to client->adapter->timeout as a signed 32-bit integer and reinterpreted as a negative number. When this negative value is passed to wait for completion timeout(), it undergoes sign extension to a 64-bit unsigned long, causing premature returns and leaving the SMBus state machine in an unrecoverable state, which leads to a local Denial of Service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.