I2C Vulnerability in Realtek RTL9300 Chipset Affects Linux Kernel

CVE-2025-39928

What is CVE-2025-39928?

A vulnerability in the Linux kernel affects the Realtek RTL9300 I2C communication. This issue arises when the data length is set to an unsupported value of 0, leading to unintended behaviors such as an underflow in the register calculations. Specifically, the SMBus Quick Operation is compromised, enabling erroneous 16-byte transfers instead of the intended quick write operation. As a result, this can lead to severe repercussions including potential bricking of devices that lack write-protected EEPROM. Adding robust checks for data lengths is vital to mitigate these risks.

References