CVE-2026-52948

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl<br /> <br /> While fuzzing with Syzkaller, a persistent `schedule_timeout: wrong<br /> timeout value` warning was observed, accompanied by SMBus controller<br /> state machine corruption.<br /> <br /> The I2C_TIMEOUT ioctl accepts a user-provided timeout in multiples of<br /> 10 ms. The user argument is checked against INT_MAX, but it is<br /> subsequently multiplied by 10 before being passed to msecs_to_jiffies().<br /> <br /> A malicious user can pass a large value (e.g., 429496729) that passes<br /> the `arg &gt; INT_MAX` check but overflows when multiplied by 10. This<br /> results in a truncated 32-bit unsigned value that bypasses the<br /> internal `(int)m adapter-&gt;timeout`<br /> (a signed 32-bit int), which is reinterpreted as a negative number.<br /> When passed to wait_for_completion_timeout(), this negative value<br /> undergoes sign extension to a 64-bit unsigned long, triggering the<br /> `schedule_timeout` warning and causing premature returns. This leaves<br /> the SMBus state machine in an unrecoverable state, constituting a<br /> local Denial of Service (DoS).<br /> <br /> Fix this by bounding the user argument to `INT_MAX / 10`.<br /> <br /> [wsa: move the comment as well]