CVE-2026-80931: Linux Kernel DS28E17 Buffer Overflow

CVE-2026-80931 Overview

CVE-2026-80931 is an out-of-bounds write vulnerability in the Linux kernel's w1 (1-Wire) subsystem, specifically in the DS28E17 1-Wire to I2C bridge driver. The w1_f19_i2c_master_transfer() function fails to validate the length byte returned by a downstream I2C device during an I2C_M_RECV_LEN block read. A malicious or malfunctioning slave device can supply a length value up to 255 bytes, causing the driver to write approximately 222 bytes past the caller's buffer, which is fixed at I2C_SMBUS_BLOCK_MAX + 2 (34 bytes).

Critical Impact
A malicious 1-Wire peripheral can trigger kernel memory corruption, enabling denial of service or local privilege escalation on affected systems.

Affected Products

Linux kernel (mainline and stable trees containing the DS28E17 driver)
Systems using the w1-ds28e17 module for 1-Wire to I2C bridging
Embedded and IoT devices exposing DS28E17-connected peripherals

Discovery Timeline

2026-09-11 - CVE-2026-80931 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80931

Vulnerability Analysis

The DS28E17 driver implements w1_f19_i2c_master_transfer() as its master_xfer callback for the 1-Wire to I2C bridge. On an I2C_M_RECV_LEN transaction, the driver reads a length byte from the downstream slave into buf[0], then calls w1_f19_i2c_read() to fetch that many additional bytes into buf[1]. The internal read helper only rejects a zero-length count, permitting attacker-controlled values from 1 to 255.

Because the caller buffer is sized at I2C_SMBUS_BLOCK_MAX + 2 (34 bytes), any length above 32 causes the write to overrun the destination. The overrun reaches up to 222 bytes beyond the buffer boundary, corrupting adjacent kernel memory. This constitutes an out-of-bounds write [CWE-787].

The SMBus core does validate buf[0] against I2C_SMBUS_BLOCK_MAX, but this check runs only after master_xfer returns. By that point the memory corruption has already occurred. In contrast, i2c-algo-bit rejects oversized lengths before the copy and returns -EPROTO.

Root Cause

The root cause is missing input validation on a length field controlled by an untrusted downstream device. The driver trusts the length byte returned by the DS28E17 slave without bounding it against I2C_SMBUS_BLOCK_MAX prior to invoking the read copy operation.

Attack Vector

Exploitation requires local access with the ability to attach or influence a 1-Wire peripheral connected via a DS28E17 bridge. An attacker controlling the slave device response, or a compromised peripheral on a shared bus, can return a crafted length byte. The kernel then performs the oversized read, corrupting kernel heap or stack memory adjacent to the transfer buffer.

The fix, applied in multiple stable branches, rejects any length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN call sites, matching the behavior of i2c-algo-bit. See the kernel commit 0f6496b34 and related backports for the patch details.

Detection Methods for CVE-2026-80931

Indicators of Compromise

Kernel panics or Oops messages referencing w1_f19_i2c_master_transfer or w1_f19_i2c_read in dmesg or /var/log/kern.log.
KASAN reports flagging out-of-bounds writes in the w1-ds28e17 module on kernels built with sanitizers.
Unexpected -EPROTO errors from I2C transactions after applying the patch, indicating a misbehaving peripheral.

Detection Strategies

Enumerate loaded kernel modules and flag hosts where w1-ds28e17 is present on unpatched kernel versions.
Correlate kernel crash telemetry with 1-Wire bus activity to identify anomalous slave device responses.
Audit hardware inventories to identify systems using DS28E17 bridges and prioritize them for patch validation.

Monitoring Recommendations

Ship kernel logs to a centralized logging pipeline and alert on driver-related oops or WARN traces.
Monitor I2C error counters and driver-level statistics for spikes in protocol errors following patch deployment.
Track kernel version and module load state across the fleet to confirm remediation coverage.

How to Mitigate CVE-2026-80931

Immediate Actions Required

Update to a Linux kernel release that includes the DS28E17 length-validation fix on all affected systems.
If patching is not immediately feasible, unload the w1-ds28e17 module and blacklist it on hosts that do not require the driver.
Restrict physical and logical access to 1-Wire buses connected to production or high-value systems.

Patch Information

The upstream fix is captured in multiple stable-tree commits: 0f6496b34, 169ae5e65e, 1d08877fc3, 6df05f630c, ae0c79a852, b30c021c60, bf76d61e11, and cb55c5da98. Apply the corresponding distribution kernel update for your supported branch.

Workarounds

Blacklist the w1-ds28e17 module in /etc/modprobe.d/ on systems that do not require DS28E17 functionality.
Physically disconnect untrusted 1-Wire peripherals until patched kernels are deployed.
Enforce hardware supply-chain controls to prevent unauthorized DS28E17-attached devices from being introduced.

bash

# Blacklist the vulnerable module until the host is patched
echo "blacklist w1_ds28e17" | sudo tee /etc/modprobe.d/blacklist-w1-ds28e17.conf
sudo rmmod w1_ds28e17 2>/dev/null || true
sudo update-initramfs -u