CVE-2026-52948: Linux Kernel I2C Timeout DoS Vulnerability

CVE-2026-52948 Overview

CVE-2026-52948 is an integer overflow vulnerability in the Linux kernel's i2c-dev driver, specifically affecting the I2C_TIMEOUT ioctl handler. The flaw was discovered through Syzkaller fuzzing, which produced a persistent schedule_timeout: wrong timeout value warning along with SMBus controller state machine corruption. A local attacker can supply a crafted timeout value that bypasses the existing INT_MAX boundary check and corrupts the I2C adapter timeout state. The result is a local Denial of Service (DoS) condition in which the SMBus state machine becomes unrecoverable.

Critical Impact
A local user can trigger an integer overflow in the I2C_TIMEOUT ioctl, leaving the SMBus controller in an unrecoverable state and causing a Denial of Service on affected Linux systems.

Affected Products

Linux kernel i2c-dev driver (multiple stable branches, per the linked kernel.org commits)
Systems exposing /dev/i2c-* character devices to userspace
Distributions shipping unpatched Linux kernels with the I2C_TIMEOUT ioctl handler

Discovery Timeline

2026-06-24 - CVE-2026-52948 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52948

Vulnerability Analysis

The vulnerability resides in the I2C_TIMEOUT ioctl handler within the Linux kernel's i2c-dev driver. The ioctl accepts a user-supplied timeout value expressed in multiples of 10 milliseconds. The handler validates the raw argument against INT_MAX before further processing. However, the argument is then multiplied by 10 and passed into msecs_to_jiffies(), which is where the safety check breaks down.

A local attacker can pass a value such as 429496729, which satisfies the arg > INT_MAX check but overflows the 32-bit unsigned arithmetic when multiplied by 10. The truncated result also bypasses the internal (int)m < 0 sentinel inside msecs_to_jiffies(). The resulting value is assigned to client->adapter->timeout, a signed 32-bit integer, where it is reinterpreted as a negative number.

When this negative value is later passed to wait_for_completion_timeout(), it is sign-extended to a 64-bit unsigned long, producing an enormous value that triggers the schedule_timeout warning and causes premature returns. The SMBus state machine is left in an unrecoverable state, yielding a local DoS.

Root Cause

The root cause is a numeric truncation and sign-extension error [Integer Overflow]. The kernel validates the user-supplied argument before scaling it, allowing values up to INT_MAX to pass even though they overflow when multiplied by 10. The fix bounds the user argument to INT_MAX / 10 so that the subsequent multiplication cannot overflow.

Attack Vector

Exploitation requires local access and the ability to open an I2C character device such as /dev/i2c-N. The attacker invokes the I2C_TIMEOUT ioctl with a crafted value greater than INT_MAX / 10 but less than or equal to INT_MAX. No remote vector exists, and no kernel memory disclosure or code execution is reported. Impact is restricted to corruption of the I2C adapter timeout field and resulting SMBus DoS.

// No verified public exploit code is available for CVE-2026-52948.
// See the upstream kernel commits for the corrective patch and
// detailed handling of the truncation in the I2C_TIMEOUT ioctl path.

Refer to the upstream fixes such as Kernel Git Commit 4576621 and Kernel Git Commit 0b88ecf for the authoritative patch series.

Detection Methods for CVE-2026-52948

Indicators of Compromise

Kernel log entries containing schedule_timeout: wrong timeout value originating from I2C or SMBus code paths.
I2C or SMBus transactions hanging or returning errors after a successful I2C_TIMEOUT ioctl from an unprivileged process.
Unexpected stalls in drivers that depend on the affected I2C adapter, including sensors, EEPROMs, and SMBus controllers.

Detection Strategies

Audit ioctl system calls targeting /dev/i2c-* devices and flag I2C_TIMEOUT requests with argument values greater than INT_MAX / 10.
Correlate kernel ring buffer warnings about schedule_timeout with the process and file descriptor that issued the preceding ioctl.
Track non-root processes that open I2C character devices, since legitimate access is normally limited to privileged daemons.

Monitoring Recommendations

Forward dmesg and journald kernel messages to a centralized log platform and alert on schedule_timeout: wrong timeout value.
Monitor for I2C adapter resets or repeated SMBus controller initialization events, which can indicate post-exploitation recovery attempts.
Use kernel auditing (auditd) rules to record ioctl calls against I2C device nodes for forensic review.

How to Mitigate CVE-2026-52948

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry, including Kernel Git Commit 4576621 and the related stable backports.
Track your distribution's security advisories and install the fixed kernel package for your supported stable branch.
Restrict access to /dev/i2c-* device nodes to trusted users and services using filesystem permissions or device cgroups.

Patch Information

The fix bounds the user-supplied argument in the I2C_TIMEOUT ioctl to INT_MAX / 10 before multiplying by 10, eliminating the overflow path into msecs_to_jiffies(). The patch has been merged upstream and propagated to multiple stable trees. Authoritative commits include Kernel Git Commit 0b88ecf, Kernel Git Commit 617eb7c, Kernel Git Commit 943e318, Kernel Git Commit aa6ef73, Kernel Git Commit e9ffd5f, Kernel Git Commit ff02add, and Kernel Git Commit ffbcf31.

Workarounds

Remove or restrict the i2c-dev module on systems that do not require user-space I2C access using rmmod i2c-dev or a modprobe blacklist.
Tighten permissions on /dev/i2c-* so that only root or a dedicated hardware-management group can issue ioctls.
Where possible, run untrusted workloads in containers or VMs that do not expose host I2C devices to the guest.

bash

# Configuration example: restrict access to I2C device nodes
# 1. Blacklist the i2c-dev module if user-space I2C is not needed
echo 'blacklist i2c-dev' | sudo tee /etc/modprobe.d/blacklist-i2c-dev.conf

# 2. Restrict permissions on existing I2C devices
sudo chown root:i2c /dev/i2c-*
sudo chmod 0660 /dev/i2c-*

# 3. Persist permissions via udev
cat <<'EOF' | sudo tee /etc/udev/rules.d/99-i2c-restrict.rules
KERNEL=="i2c-[0-9]*", GROUP="i2c", MODE="0660"
EOF
sudo udevadm control --reload-rules