CVE-2025-39928 i2c: rtl9300: ensure data length is within supported range
An integer underflow in the RTL9300 I2C driver allows attackers to corrupt hardware EEPROMs, potentially bricking connected devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39928?
CVE-2025-39928 is a high-severity vulnerability in Linux kernel, published on 1 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
i2c: rtl9300: ensure data length is within supported range
Add an explicit check for the xfer length to 'rtl9300_i2c_config_xfer' to ensure the data length isn't within the supported range. In particular a data length of 0 is not supported by the hardware and causes unintended or destructive behaviour.
This limitation becomes obvious when looking at the register documentation [1]. 4 bits are reserved for DATA_WIDTH and the value of these 4 bits is used as N + 1, allowing a data length range of 1 <= len <= 16.
Affected by this is the SMBus Quick Operation which works with a data length of 0. Passing 0 as the length causes an underflow of the value due to:
(len - 1) & 0xf
and effectively specifying a transfer length of 16 via the registers. This causes a 16-byte write operation instead of a Quick Write. For example, on SFP modules without write-protected EEPROM this soft-bricks them by overwriting some initial bytes.
For completeness, also add a quirk for the zero length.
[1] https://svanheule.net/realtek/longan/register/i2c_mst1_ctrl2
Weakness: CWE-191
Which versions are affected by CVE-2025-39928?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39928?
Apply the vendor's patch.
Is CVE-2025-39928 being exploited?
There is no known exploitation of CVE-2025-39928 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-39928, DEBIAN-CVE-2025-39928, GHSA-m43q-hvcx-4pxc, UBUNTU-CVE-2025-39928.