In the Linux kernel, the following vulnerability has been resolved:
HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error:
BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107
CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0)
Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-debugUpgrade kernel-cross-headersUpgrade kernel-rt-debug-modulesUpgrade kernel-64kUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-debug-uki-virtUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-develUpgrade kernel-modulesUpgrade perfUpgrade kernel-debug-develUpgrade kernel-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-develUpgrade kernelUpgrade kernel-zfcpdump-develUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade rtlaUpgrade kernel-rt-64k-debugUpgrade kernel-rt-debug-develUpgrade kernel-64k-modules-extraUpgrade kernel-rt-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-64k-modulesUpgrade python3-perfUpgrade kernel-modules-coreUpgrade kernel-headersUpgrade kernel-rt-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-64k-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-develUpgrade kernel-64k-debug-devel-matchedUpgrade libperfUpgrade kernel-rt-debug-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-modulesUpgrade kernel-64k-coreUpgrade kernel-abi-stablelistsUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-rt-64kUpgrade kernel-rt-debug-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rtUpgrade kernel-rt-64k-debug-coreUpgrade rvUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-toolsUpgrade kernel-zfcpdumpUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-64k-debug-develUpgrade kernel-uki-virtUpgrade kernel-64k-debugUpgrade kernel-docUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-debug-modules-core | Mar 23, 2026 | Mar 17, 2026 |
| Oracle_linux | — | Upgrade kernel | Mar 12, 2026 | Sep 16, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rt | Mar 10, 2026 | Sep 16, 2025 |
| Rocky_linux | — | Upgrade kernel-tools-libsUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-debuginfo-common-s390xUpgrade rvUpgrade kernelUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-rtUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-coreUpgrade libperfUpgrade libperf-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-debug-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-toolsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-coreUpgrade kernel-debug-develUpgrade kernel-rt-debugUpgrade rtlaUpgrade kernel-rt-develUpgrade kernel-debuginfoUpgrade kernel-debug-coreUpgrade perf-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade python3-perf-debuginfoUpgrade perfUpgrade kernel-zfcpdump-develUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade python3-perfUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-uki-virtUpgrade kernel-develUpgrade kernel-modules | Mar 31, 2026 | Mar 26, 2026 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-realtime-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-aws-6.14Upgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-raspi-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-gcp-6.14Upgrade linux-image-azure-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-36-genericUpgrade linux-image-6.14.0-1017-awsUpgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1017-azureUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-realtimeUpgrade linux-image-oracleUpgrade linux-image-virtual-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-gcpUpgrade linux-image-generic-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-genericUpgrade linux-image-virtualUpgrade linux-image-aws-64k-6.14Upgrade linux-image-aws-64kUpgrade linux-image-oem-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1017-aws-64k | Sep 19, 2025 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub