CVE-2026-46001: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-46001 Overview

CVE-2026-46001 is a Linux kernel vulnerability in the pt5161l hardware monitoring (hwmon) driver. The flaw resides in the pt5161l_read_block_data() function, which improperly handles return values from i2c_smbus_read_block_data(). The driver declares a 24-byte local buffer (u8 rbuf[24]), but the I2C SMBus block read can return up to I2C_SMBUS_BLOCK_MAX (32) bytes. The i2c-core copies data into the caller's buffer before length validation, producing a stack buffer overrun when a device returns more than 24 bytes. A second defect causes the function to return a positive byte count on length mismatch after retries, leading callers to process stale or incomplete data.

Critical Impact

A malicious or malfunctioning I2C device can trigger a kernel stack overrun in the pt5161l driver, potentially leading to kernel memory corruption or denial of service.

Affected Products

• Linux kernel versions containing the pt5161l hwmon driver prior to the fix commits
• Stable kernel branches referenced by commits 24c73e93d6a7, 7eccabff1c9e, 95d48e37a130, and a11aa9c5fd9d
• Systems exposing the Astera Labs PT5161L PCIe retimer hardware monitor over I2C/SMBus

Discovery Timeline

• 2026-05-27 - CVE-2026-46001 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46001

Vulnerability Analysis

The pt5161l driver provides hwmon telemetry for the Astera Labs PT5161L PCIe retimer through SMBus block reads. Inside pt5161l_read_block_data(), a stack-allocated buffer u8 rbuf[24] receives data from i2c_smbus_read_block_data(). The SMBus block read protocol allows a peripheral to return up to 32 bytes (I2C_SMBUS_BLOCK_MAX), and the i2c-core writes the returned bytes into the caller's buffer before the driver inspects the length. Validation after the copy cannot prevent the resulting out-of-bounds write [CWE-121].

The second defect involves return value semantics. When the driver retries three times and each attempt returns an unexpected length, the function passes the positive byte count back to its caller. Callers interpret any non-negative return as success and operate on partially populated or stale buffer contents, producing incorrect sensor readings or downstream logic errors.

Root Cause

The root cause is an undersized stack buffer combined with a trust boundary mismatch. The driver assumes the device returns at most 24 bytes, but the I2C subsystem honors the protocol maximum of 32 bytes. Because i2c-core copies first and reports length second, post-hoc validation is ineffective. The retry path additionally fails to translate a length-mismatch condition into a negative error code.

Attack Vector

Exploitation requires a hostile or faulty I2C/SMBus device that returns a block read response exceeding 24 bytes. On systems where untrusted hardware can be attached to an I2C bus serviced by the pt5161l driver, or where a compromised peripheral can craft a non-conforming response, the overrun corrupts adjacent kernel stack memory. The practical impact is typically denial of service through kernel panic, with kernel memory corruption possible depending on stack layout and mitigations such as CONFIG_STACKPROTECTOR.

No public exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The flaw was identified and fixed upstream as part of routine kernel hardening of the hwmon subsystem. Refer to the Kernel Git Commit Security Fix 1 for the upstream patch.

Detection Methods for CVE-2026-46001

Indicators of Compromise

• Kernel oops or panic messages referencing pt5161l_read_block_data or stack canary violations in the pt5161l module
• Unexpected hwmon sensor readings or repeated I2C transaction failures logged against the PT5161L retimer
• Dmesg entries showing i2c_smbus_read_block_data returning byte counts outside the expected range for pt5161l transactions

Detection Strategies

• Inventory hosts loading the pt5161l kernel module via lsmod or /proc/modules and cross-reference kernel versions against the patched stable releases
• Monitor kernel ring buffer logs for stack protector terminations (Kernel stack is corrupted) correlated with hwmon I2C activity
• Audit hardware bills of materials for systems containing Astera Labs PT5161L retimers exposed to the affected driver path

Monitoring Recommendations

• Forward dmesg and journald kernel logs to a centralized analytics platform and alert on pt5161l errors or panic signatures
• Track kernel package versions across the fleet to confirm patched builds are deployed where the pt5161l driver is in use
• Baseline hwmon sensor read intervals and flag sustained I2C error rates that may indicate a misbehaving or malicious peripheral

How to Mitigate CVE-2026-46001

Immediate Actions Required

• Upgrade to a Linux kernel release that includes the upstream fix commits 24c73e93d6a7, 7eccabff1c9e, 95d48e37a130, or a11aa9c5fd9d
• Restrict physical and logical access to I2C/SMBus interfaces on systems running the pt5161l driver
• Validate that distribution stable kernels deployed across the fleet incorporate the backported hwmon pt5161l patches

Patch Information

The fix resizes the local buffer to I2C_SMBUS_BLOCK_MAX to eliminate the stack overrun, and returns -EIO when all retries exhaust with a length mismatch so callers no longer treat a positive count as success. Patches are available at Kernel Git Commit Security Fix 1, Kernel Git Commit Security Fix 2, Kernel Git Commit Security Fix 3, and Kernel Git Commit Security Fix 4.

Workarounds

• Blacklist the pt5161l module on systems that do not require PT5161L hwmon telemetry until a patched kernel is installed
• Enable CONFIG_STACKPROTECTOR_STRONG and CONFIG_FORTIFY_SOURCE in kernel builds to reduce exploitability of stack overruns
• Where feasible, isolate untrusted I2C devices from buses that service the pt5161l driver

# Blacklist the pt5161l module until a patched kernel is deployed
echo 'blacklist pt5161l' | sudo tee /etc/modprobe.d/blacklist-pt5161l.conf
sudo rmmod pt5161l 2>/dev/null || true
sudo update-initramfs -u