In the Linux kernel, the following vulnerability has been resolved:
HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length
The QuickI2C ACPI _DSD methods return ICRS and ISUB data with a trailing byte, making the actual length is one more byte than the structs defined.
It caused stack-out-of-bounds and kernel crash:
kernel: BUG: KASAN: stack-out-of-bounds in quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: Write of size 12 at addr ffff888106d1f900 by task kworker/u33:2/75 kernel: kernel: CPU: 3 UID: 0 PID: 75 Comm: kworker/u33:2 Not tainted 6.16.0+ #3 PREEMPT(voluntary) kernel: Workqueue: async async_run_entry_fn kernel: Call Trace: kernel: <TASK> kernel: dump_stack_lvl+0x76/0xa0 kernel: print_report+0xd1/0x660 kernel: ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kernel: ? __kasan_slab_free+0x5d/0x80 kernel: ? kasan_addr_to_slab+0xd/0xb0 kernel: kasan_report+0xe1/0x120 kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: kasan_check_range+0x11c/0x200 kernel: __asan_memcpy+0x3b/0x80 kernel: quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? __pfx_quicki2c_acpi_get_dsd_property.constprop.0+0x10/0x10 [intel_quicki2c] kernel: quicki2c_get_acpi_resources+0x237/0x730 [intel_quicki2c] [...] kernel: </TASK> kernel: kernel: The buggy address belongs to stack of task kworker/u33:2/75 kernel: and is located at offset 48 in frame: kernel: quicki2c_get_acpi_resources+0x0/0x730 [intel_quicki2c] kernel: kernel: This frame has 3 objects: kernel: [32, 36) 'hid_desc_addr' kernel: [48, 59) 'i2c_param' kernel: [80, 224) 'i2c_config'
ACPI DSD methods return:
\_SB.PC00.THC0.ICRS Buffer 000000003fdc947b 001 Len 0C = 0A 00 80 1A 06 00 00 00 00 00 00 00 \_SB.PC00.THC0.ISUB Buffer 00000000f2fcbdc4 001 Len 91 = 00 00 00 00 00 00 00 00 00 00 00 00
Adding reserved padding to quicki2c_subip_acpi_parameter/config.
CVSS Details
- CVSS 3.1 Base Score: 8.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 16, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-6.14.0-36-genericUpgrade linux-image-realtime-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-gcp-64kUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-raspiUpgrade linux-image-azureUpgrade linux-image-oracle-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-aws-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-1017-azureUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-awsUpgrade linux-image-realtimeUpgrade linux-image-oracleUpgrade linux-image-aws-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-generic-64k-6.14Upgrade linux-image-generic-64kUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-genericUpgrade linux-image-6.14.0-1017-awsUpgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-gcpUpgrade linux-image-oracle-64kUpgrade linux-image-virtual-6.14Upgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-aws-64k-6.14Upgrade linux-image-azure-6.14Upgrade linux-image-oem-24.04a | Sep 19, 2025 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub