CVE-2026-31627: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31627 is a buffer overflow/out-of-bounds memory access vulnerability in the Linux kernel's i2c s3c24xx driver, caused by missing validation of the SMBUS message size field. The first byte of an i2c SMBUS message represents the payload size and was not being checked to ensure it falls within the valid range of 0 to I2C_SMBUS_BLOCK_MAX before processing. The vulnerability was published on April 24, 2026, and affects Linux kernel versions from 3.10 through 7.0.0 across multiple stable branches. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is insufficient input validation (analogous to CWE-1284: Improper Validation of Specified Quantity in Input) in the i2c-s3c24xx driver. When processing an SMBUS block read, the driver uses the first byte of the message as a length value without verifying it is within the acceptable range of 0 to I2C_SMBUS_BLOCK_MAX (32 bytes). A locally authenticated attacker with low privileges can craft a malicious SMBUS message with an oversized length field, causing the driver to read or write beyond the intended buffer boundaries in kernel memory. The fix mirrors the approach taken in commit a6e04f05ce0b for the i2c tegra driver, adding an explicit bounds check before the size value is used (GitHub Advisory, Feedly).

Successful exploitation by a local low-privileged attacker can result in high impact to confidentiality, integrity, and availability of the affected system. Specifically, an attacker may read sensitive kernel memory (information disclosure), corrupt kernel data structures (integrity compromise), or trigger kernel crashes leading to denial of service. The vulnerability is scoped to the local system and does not directly enable remote code execution, but kernel memory access could facilitate privilege escalation or lateral movement on multi-tenant systems (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015–0.018%, placing it in a low percentile for near-term exploitation likelihood. Exploitation requires local access with at least low-level privileges and access to the i2c/SMBUS device interface (GitHub Advisory, Feedly).

Patches are available across multiple Linux kernel stable branches. Administrators should upgrade to the following fixed versions: 6.6.136 (for 6.6.x branch), 6.12.83 (for 6.12.x branch), 6.18.24 (for 6.18.x branch), 6.19.14 (for 6.19.x branch), or 7.0.1 (for 7.0.x branch). As an interim workaround on systems that cannot be immediately patched, restrict unprivileged user access to i2c device interfaces (e.g., via udev rules or file permissions) and disable the i2c-s3c24xx kernel module if it is not required for system functionality (modprobe -r i2c-s3c24xx). Monitor systems for unexpected kernel crashes or i2c-related errors in kernel logs (Feedly, GitHub Advisory).