In the Linux kernel, the following vulnerability has been resolved:
HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error:
BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107
CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0)
Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-64k-debug-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rtUpgrade libperfUpgrade kernel-rt-modulesUpgrade kernel-tools-libs-develUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-devel-matchedUpgrade rvUpgrade kernel-tools-libsUpgrade kernel-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-docUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-uki-virtUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdumpUpgrade kernel-64k-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-64kUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-toolsUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-debugUpgrade kernel-modules-coreUpgrade python3-perfUpgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-rt-coreUpgrade kernelUpgrade kernel-debug-develUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-64kUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-rt-debug-develUpgrade kernel-rt-64k-debugUpgrade rtlaUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-rt-debugUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-modules-extraUpgrade kernel-coreUpgrade kernel-64k-develUpgrade kernel-64k-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-headersUpgrade kernel-debug-coreUpgrade kernel-develUpgrade kernel-rt-develUpgrade kernel-debug-uki-virtUpgrade perfUpgrade kernel-64k-modules-core | Mar 23, 2026 | Mar 17, 2026 |
| Oracle_linux | — | Upgrade kernel | Mar 12, 2026 | Sep 16, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernel | Mar 10, 2026 | Sep 16, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-modules-extraUpgrade rvUpgrade kernelUpgrade kernel-zfcpdumpUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade kernel-debuginfo-common-s390xUpgrade kernel-tools-libsUpgrade kernel-rtUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-modulesUpgrade libperf-debuginfoUpgrade libperfUpgrade kernel-debug-debuginfoUpgrade kernel-toolsUpgrade kernel-debug-modules-coreUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-develUpgrade kernel-rt-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-develUpgrade perfUpgrade kernel-rt-debug-modules-coreUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extraUpgrade python3-perfUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade kernel-coreUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade kernel-modulesUpgrade kernel-develUpgrade kernel-debug-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-coreUpgrade kernel-debug-coreUpgrade rtlaUpgrade kernel-rt-debug-modules-extra | Mar 31, 2026 | Mar 26, 2026 |
| Ubuntu | — | Upgrade linux-image-awsUpgrade linux-image-oracle-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-gcp-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-6.14.0-1017-awsUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-6.14.0-1017-azureUpgrade linux-image-6.14.0-36-genericUpgrade linux-image-gcp-64kUpgrade linux-image-aws-6.14Upgrade linux-image-realtime-6.14Upgrade linux-image-azureUpgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-raspi-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-azure-6.14Upgrade linux-image-aws-64kUpgrade linux-image-oem-24.04Upgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-oracleUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtual-6.14Upgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-realtimeUpgrade linux-image-oem-24.04aUpgrade linux-image-genericUpgrade linux-image-virtualUpgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-generic-64k-6.14Upgrade linux-image-generic-64kUpgrade linux-image-gcpUpgrade linux-image-aws-64k-6.14 | Sep 19, 2025 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub