In the Linux kernel, the following vulnerability has been resolved:
hwmon: (tps53679) Fix array access with zero-length block read
i2c_smbus_read_block_data() can return 0, indicating a zero-length
read. When this happens, tps53679_identify_chip() accesses buf[ret - 1]
which is buf[-1], reading one byte before the buffer on the stack.
Fix by changing the check from "ret < 0" to "ret <= 0", treating a
zero-length read as an error (-EIO), which prevents the out-of-bounds
array access.
Also fix a typo in the adjacent comment: "if present" instead of
duplicate "if".
References
Configurations
Configuration 1 (hide)
|
History
12 May 2026, 19:27
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-125 | |
| First Time |
Linux linux Kernel
Linux |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
| CPE | cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/0e211f6aaa6a00fd0ee0c1eea5498f168c6725e6 - Patch | |
| References | () https://git.kernel.org/stable/c/6999b4769e2a61c463158927102e8c07e3f69ba2 - Patch | |
| References | () https://git.kernel.org/stable/c/79b7e588399bb55f4c10bea6ca41b6c3b944d2bb - Patch |
01 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-01 15:16
Updated : 2026-05-12 19:27
NVD link : CVE-2026-43005
Mitre link : CVE-2026-43005
CVE.ORG link : CVE-2026-43005
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-125
Out-of-bounds Read