Linux Kernel EUVD-2026-86166

Requires local access to an SMBus/I2C interface exposed via /dev/i2c-* (i2cdev), which on most systems is restricted to root or an i2c group, and the ability to issue I2C_SMBUS ioctls with a caller-supplied block length. The two demonstrated bugs each need a non-default configuration: Bug 1 requires SMBus tracepoints/tracing to be enabled so trace_smbus_write() fires before validation; Bug 2 requires the i2c-stub testing module to be loaded (its stub_xfer only clamps against 256-command, not I2C_SMBUS_BLOCK_MAX). More generally, any adapter whose native .smbus_xfer callback trusts the caller-supplied block[0] is reachable, but that depends on the specific hardware/driver present. Default production kernels without tracing enabled, without i2c-stub, and without unprivileged /dev/i2c access are not readily exploitable.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) marks this as a local, low-privilege, high-impact kernel memory-safety flaw. That base score overstates real-world urgency once the multi-source signals are weighed. There is no CISA KEV listing, no EPSS score provided, and no public exploit code in the intelligence set - the crash traces in the description are the reporter's own KASAN/UBSAN reproductions on v7.0-rc6, not weaponized public POCs. Both demonstrated bugs are also gated by non-default conditions: Bug 1 (smbus_write tracepoint OOB) only fires when SMBus tracepoints/tracing are enabled, and Bug 2 requires the i2c-stub debug module (a test-only driver) to be loaded. The demonstrated primitives are out-of-bounds READS (KASAN 'stack-out-of-bounds' read, UBSAN 'array-index-out-of-bounds'), which supports C:H and A:H (crash) but makes NVD's I:H questionable. Exploitation also presupposes access to /dev/i2c-* character devices, which are typically restricted to root or an i2c group, consistent with PR:L but further narrowing the realistic attacker population. Net: a legitimate defense-in-depth kernel hardening fix, but a moderate/low real-world priority rather than an emergency - no active exploitation, no public exploit, and non-default preconditions for the demonstrated paths.

A local user with access to an /dev/i2c-* device issues an I2C_SMBUS ioctl supplying an oversized block length (e.g. block[0]=0xfe or 0xff) for a caller-supplied block write/transfer. On a kernel with SMBus tracepoints enabled or the i2c-stub module loaded, this drives an out-of-bounds memory access (255-byte copy into a 34-byte buffer / array index past the union), leaking adjacent kernel memory or crashing the system. No public exploit code is provided; the description contains only the reporter's KASAN/UBSAN reproduction traces.