{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/i2c-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e9ffd5f5050fbb199d270a85614cd27ebed6fbac",
              "status": "affected",
              "version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
              "versionType": "git"
            },
            {
              "lessThan": "0b88ecfbc9dc33b4db8836c37b50cf174e6c0691",
              "status": "affected",
              "version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
              "versionType": "git"
            },
            {
              "lessThan": "943e318eedbeaeea08ece3f5dd44c982f4ed2ef5",
              "status": "affected",
              "version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
              "versionType": "git"
            },
            {
              "lessThan": "aa6ef734016912653a909477fb30aeb66c98b3a2",
              "status": "affected",
              "version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
              "versionType": "git"
            },
            {
              "lessThan": "ff02add34ffd03449b8115904ebe2ec4fed022d4",
              "status": "affected",
              "version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
              "versionType": "git"
            },
            {
              "lessThan": "ffbcf31f032eb454ebfd29309f51366fe57f4ac4",
              "status": "affected",
              "version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
              "versionType": "git"
            },
            {
              "lessThan": "4576621dc6577f21a032acfd16c3ad61907a5ea7",
              "status": "affected",
              "version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
              "versionType": "git"
            },
            {
              "lessThan": "617eb7c0961a8dfcfc811844a6396e406b2923ea",
              "status": "affected",
              "version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/i2c-dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl\n\nWhile fuzzing with Syzkaller, a persistent `schedule_timeout: wrong\ntimeout value` warning was observed, accompanied by SMBus controller\nstate machine corruption.\n\nThe I2C_TIMEOUT ioctl accepts a user-provided timeout in multiples of\n10 ms. The user argument is checked against INT_MAX, but it is\nsubsequently multiplied by 10 before being passed to msecs_to_jiffies().\n\nA malicious user can pass a large value (e.g., 429496729) that passes\nthe `arg \u003e INT_MAX` check but overflows when multiplied by 10. This\nresults in a truncated 32-bit unsigned value that bypasses the\ninternal `(int)m \u003c 0` check in `msecs_to_jiffies()`.\n\nThe truncated value is then assigned to `client-\u003eadapter-\u003etimeout`\n(a signed 32-bit int), which is reinterpreted as a negative number.\nWhen passed to wait_for_completion_timeout(), this negative value\nundergoes sign extension to a 64-bit unsigned long, triggering the\n`schedule_timeout` warning and causing premature returns. This leaves\nthe SMBus state machine in an unrecoverable state, constituting a\nlocal Denial of Service (DoS).\n\nFix this by bounding the user argument to `INT_MAX / 10`.\n\n[wsa: move the comment as well]"
    }
  ],
  "id": "CVE-2026-52948",
  "lastModified": "2026-06-29T06:16:29.820",
  "metrics": {},
  "published": "2026-06-24T17:17:04.900",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0b88ecfbc9dc33b4db8836c37b50cf174e6c0691"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4576621dc6577f21a032acfd16c3ad61907a5ea7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/617eb7c0961a8dfcfc811844a6396e406b2923ea"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/943e318eedbeaeea08ece3f5dd44c982f4ed2ef5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/aa6ef734016912653a909477fb30aeb66c98b3a2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e9ffd5f5050fbb199d270a85614cd27ebed6fbac"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ff02add34ffd03449b8115904ebe2ec4fed022d4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ffbcf31f032eb454ebfd29309f51366fe57f4ac4"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-52948"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-24T17:17:04Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl\n\nWhile fuzzing with Syzkaller, a persistent `schedule_timeout: wrong\ntimeout value` warning was observed, accompanied by SMBus controller\nstate machine corruption.\n\nThe I2C_TIMEOUT ioctl accepts a user-provided timeout in multiples of\n10 ms. The user argument is checked against INT_MAX, but it is\nsubsequently multiplied by 10 before being passed to msecs_to_jiffies().\n\nA malicious user can pass a large value (e.g., 429496729) that passes\nthe `arg \u003e INT_MAX` check but overflows when multiplied by 10. This\nresults in a truncated 32-bit unsigned value that bypasses the\ninternal `(int)m \u003c 0` check in `msecs_to_jiffies()`.\n\nThe truncated value is then assigned to `client-\u003eadapter-\u003etimeout`\n(a signed 32-bit int), which is reinterpreted as a negative number.\nWhen passed to wait_for_completion_timeout(), this negative value\nundergoes sign extension to a 64-bit unsigned long, triggering the\n`schedule_timeout` warning and causing premature returns. This leaves\nthe SMBus state machine in an unrecoverable state, constituting a\nlocal Denial of Service (DoS).\n\nFix this by bounding the user argument to `INT_MAX / 10`.\n\n[wsa: move the comment as well]",
  "id": "GHSA-rj5f-9xf7-69h7",
  "modified": "2026-06-24T18:32:41Z",
  "published": "2026-06-24T18:32:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52948"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0b88ecfbc9dc33b4db8836c37b50cf174e6c0691"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4576621dc6577f21a032acfd16c3ad61907a5ea7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/617eb7c0961a8dfcfc811844a6396e406b2923ea"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/943e318eedbeaeea08ece3f5dd44c982f4ed2ef5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aa6ef734016912653a909477fb30aeb66c98b3a2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e9ffd5f5050fbb199d270a85614cd27ebed6fbac"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ff02add34ffd03449b8115904ebe2ec4fed022d4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ffbcf31f032eb454ebfd29309f51366fe57f4ac4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-52948 i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-52948.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl",
    "tracking": {
      "current_release_date": "2026-06-28T01:54:41.000Z",
      "generator": {
        "date": "2026-06-28T07:10:57.302Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-52948",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-06-27T01:03:36.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-06-28T01:54:41.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.141.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.141.1-1.azl3",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.143.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.143.1-1.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.141.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.143.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-52948",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-2",
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-52948 i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-52948.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-06-27T01:03:36.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-2"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-06-27T01:03:36.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "title": "i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl"
    }
  ]
}