In the Linux kernel, the following vulnerability has been resolved:
HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error:
BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107
CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0)
Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernelUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64kUpgrade kernel-64k-debug-coreUpgrade kernel-zfcpdump-develUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-develUpgrade kernel-debug-uki-virtUpgrade kernel-modules-coreUpgrade perfUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-headersUpgrade kernel-64k-modules-coreUpgrade kernel-debugUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-modulesUpgrade kernel-64k-modulesUpgrade kernel-rt-debug-develUpgrade kernel-debug-develUpgrade python3-perfUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-64k-develUpgrade rtlaUpgrade kernel-coreUpgrade kernel-rt-develUpgrade kernel-modulesUpgrade kernel-64k-develUpgrade kernel-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-rt-64k-debugUpgrade kernel-64k-modules-extraUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-abi-stablelistsUpgrade kernel-64k-debug-modules-coreUpgrade rvUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-64kUpgrade kernel-rt-64k-debug-develUpgrade kernel-debug-modules-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-64k-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-rtUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade libperfUpgrade kernel-rt-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-docUpgrade kernel-64k-debugUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-rt-64k-coreUpgrade kernel-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-tools | Mar 23, 2026 | Mar 17, 2026 |
| Oracle_linux | — | Upgrade kernel | Mar 12, 2026 | Sep 16, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rt | Mar 10, 2026 | Sep 16, 2025 |
| Rocky_linux | — | Upgrade kernel-debuginfoUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-develUpgrade kernel-rt-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-uki-virtUpgrade kernel-rt-debugUpgrade perfUpgrade kernel-coreUpgrade kernel-debug-develUpgrade rtlaUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modules-extraUpgrade kernel-debug-uki-virtUpgrade python3-perfUpgrade kernel-zfcpdumpUpgrade rvUpgrade libperfUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modulesUpgrade kernel-devel-matchedUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-debug-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-debuginfo-common-s390xUpgrade kernel-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rtUpgrade kernel-uki-virt-addonsUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modules-extra | Mar 31, 2026 | Mar 26, 2026 |
| Ubuntu | — | Upgrade linux-image-aws-64k-6.14Upgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-oracle-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-virtual-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-oem-24.04Upgrade linux-image-virtualUpgrade linux-image-genericUpgrade linux-image-oem-24.04aUpgrade linux-image-aws-64kUpgrade linux-image-gcpUpgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-6.14.0-1017-awsUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-6.14.0-36-genericUpgrade linux-image-6.14.0-1017-azureUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-realtime-6.14Upgrade linux-image-gcp-6.14Upgrade linux-image-raspi-6.14Upgrade linux-image-awsUpgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-azureUpgrade linux-image-azure-6.14Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-raspiUpgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-aws-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-1020-gcp | Sep 19, 2025 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub