In the Linux kernel, the following vulnerability has been resolved:
HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error:
BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107
CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0)
Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-debug-modules-coreUpgrade rvUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-64k-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-tools-libsUpgrade kernel-tools-libs-develUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-toolsUpgrade kernel-docUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-rt-modulesUpgrade kernel-rtUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade libperfUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-rt-64kUpgrade kernel-zfcpdumpUpgrade kernel-rt-64k-debug-develUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-coreUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-develUpgrade kernel-64kUpgrade kernel-modules-coreUpgrade kernel-headersUpgrade kernelUpgrade kernel-rt-64k-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-develUpgrade kernel-64k-develUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-debugUpgrade perfUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-64k-develUpgrade kernel-debugUpgrade python3-perfUpgrade kernel-cross-headersUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-develUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-rt-modules-extraUpgrade rtlaUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debugUpgrade kernel-modulesUpgrade kernel-64k-modulesUpgrade kernel-coreUpgrade kernel-64k-modules-extraUpgrade kernel-debug-develUpgrade kernel-rt-core | Mar 23, 2026 | Mar 17, 2026 |
| Oracle_linux | — | Upgrade kernel | Mar 12, 2026 | Sep 16, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernel | Mar 10, 2026 | Sep 16, 2025 |
| Rocky_linux | — | Upgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debugUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade rtlaUpgrade kernel-rt-debug-modulesUpgrade perfUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debuginfoUpgrade kernel-debugUpgrade python3-perfUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-coreUpgrade kernel-debug-uki-virtUpgrade perf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade libperfUpgrade kernel-toolsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-tools-libs-develUpgrade libperf-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernelUpgrade rvUpgrade kernel-rtUpgrade kernel-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libsUpgrade kernel-rt-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-debug-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump | Mar 31, 2026 | Mar 26, 2026 |
| Ubuntu | — | Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.14.0-36-genericUpgrade linux-image-realtime-6.14Upgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-gcp-6.14Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-azureUpgrade linux-image-6.14.0-1017-azureUpgrade linux-image-generic-6.14Upgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-aws-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-1017-awsUpgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-awsUpgrade linux-image-oracle-6.14Upgrade linux-image-raspiUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-oracleUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-genericUpgrade linux-image-virtualUpgrade linux-image-oem-24.04aUpgrade linux-image-gcpUpgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-virtual-6.14Upgrade linux-image-generic-64kUpgrade linux-image-aws-64k-6.14Upgrade linux-image-realtimeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-aws-64kUpgrade linux-image-oem-24.04 | Sep 19, 2025 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub