The Linux kernel i2c-stub driver improperly handles I2C_SMBUS_I2C_BLOCK_DATA transfers by not validating the transfer length against I2C_SMBUS_BLOCK_MAX (32). This allows a local user with access to /dev/i2c-* to issue an ioctl with a block length greater than 32, causing stub_xfer() to read or write beyond the bounds of the i2c_smbus_data.block buffer. The root cause is that i2c-stub implements .smbus_xfer directly, bypassing the usual validation present in i2c_smbus_xfer_emulated(). The fix involves rejecting transfers where the block length is zero or exceeds the maximum allowed, returning -EINVAL to prevent out-of-bounds access.

A local attacker with access to the I2C device interface can cause a kernel stack out-of-bounds read or write, potentially leading to kernel memory corruption. This could result in system instability or a denial of service. The affected driver is a development/test stub driver, not built by default, limiting the exposure. There is no indication of known exploits in the wild.

A fix has been implemented in the Linux kernel to reject I2C block transfers with invalid lengths in the i2c-stub driver. Users should update to a kernel version that includes this fix. Since the driver is not built by default and requires explicit loading with parameters, limiting access to /dev/i2c-* devices and avoiding loading the i2c-stub module can reduce risk. Patch status is not explicitly stated; check the vendor advisory or kernel changelogs for the fixed version.