CVE-2026-98204

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98204", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.325Z", "datePublished": "2026-10-06T08:44:41.712Z", "dateUpdated": "2026-10-19T09:15:35.168Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:15:35.168Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()\n\nWhen chunking writes into SMBus blocks in rmi_smb_write_block(), the\nloop calculates block_len using the original total length (len) instead\nof the remaining length (cur_len).\n\nIf len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32\nfor every iteration, even on the final partial chunk where fewer than 32\nbytes remain. This causes smb_block_write() to read 32 bytes from the\nadvanced data buffer pointer, reading past the end of the input buffer.\n\nFix this by calculating block_len using cur_len and advancing the buffer\nand address pointers by block_len."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/input/rmi4/rmi_smbus.c"], "versions": [{"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "lessThan": "d01337c0892d1509500c727edf81380777c2dd0f", "status": "affected", "versionType": "git"}, {"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "lessThan": "7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8", "status": "affected", "versionType": "git"}, {"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "lessThan": "29fbcf5834f0a7f74bfd017c07da2411b35a4e2a", "status": "affected", "versionType": "git"}, {"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "lessThan": "50dd585bee7669eb165e5defcc35d17f3822cfbb", "status": "affected", "versionType": "git"}, {"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "lessThan": "e022538e13dd1c82af5ec25ac28f12ca0ab26160", "status": "affected", "versionType": "git"}, {"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "lessThan": "dc05ec97b8299e48e31367a9bc412c7e9c0e2b42", "status": "affected", "versionType": "git"}, {"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "lessThan": "9f0ce5e162eed8b68345abe839c59768bc60f99a", "status": "affected", "versionType": "git"}, {"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "lessThan": "51cfe54f815ae175c7d1126b983d4d7c89715004", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/input/rmi4/rmi_smbus.c"], "versions": [{"version": "4.10", "status": "affected"}, {"version": "0", "lessThan": "4.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d01337c0892d1509500c727edf81380777c2dd0f"}, {"url": "https://git.kernel.org/stable/c/7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8"}, {"url": "https://git.kernel.org/stable/c/29fbcf5834f0a7f74bfd017c07da2411b35a4e2a"}, {"url": "https://git.kernel.org/stable/c/50dd585bee7669eb165e5defcc35d17f3822cfbb"}, {"url": "https://git.kernel.org/stable/c/e022538e13dd1c82af5ec25ac28f12ca0ab26160"}, {"url": "https://git.kernel.org/stable/c/dc05ec97b8299e48e31367a9bc412c7e9c0e2b42"}, {"url": "https://git.kernel.org/stable/c/9f0ce5e162eed8b68345abe839c59768bc60f99a"}, {"url": "https://git.kernel.org/stable/c/51cfe54f815ae175c7d1126b983d4d7c89715004"}], "title": "Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/input/rmi4/rmi_smbus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d01337c0892d1509500c727edf81380777c2dd0f", "status": "affected", "version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "versionType": "git"}, {"lessThan": "7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8", "status": "affected", "version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "versionType": "git"}, {"lessThan": "29fbcf5834f0a7f74bfd017c07da2411b35a4e2a", "status": "affected", "version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "versionType": "git"}, {"lessThan": "50dd585bee7669eb165e5defcc35d17f3822cfbb", "status": "affected", "version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "versionType": "git"}, {"lessThan": "e022538e13dd1c82af5ec25ac28f12ca0ab26160", "status": "affected", "version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "versionType": "git"}, {"lessThan": "dc05ec97b8299e48e31367a9bc412c7e9c0e2b42", "status": "affected", "version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "versionType": "git"}, {"lessThan": "9f0ce5e162eed8b68345abe839c59768bc60f99a", "status": "affected", "version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "versionType": "git"}, {"lessThan": "51cfe54f815ae175c7d1126b983d4d7c89715004", "status": "affected", "version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/input/rmi4/rmi_smbus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()\n\nWhen chunking writes into SMBus blocks in rmi_smb_write_block(), the\nloop calculates block_len using the original total length (len) instead\nof the remaining length (cur_len).\n\nIf len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32\nfor every iteration, even on the final partial chunk where fewer than 32\nbytes remain. This causes smb_block_write() to read 32 bytes from the\nadvanced data buffer pointer, reading past the end of the input buffer.\n\nFix this by calculating block_len using cur_len and advancing the buffer\nand address pointers by block_len."}], "id": "CVE-2026-98204", "lastModified": "2026-10-19T10:18:21.060", "metrics": {}, "published": "2026-10-06T09:18:06.383", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/29fbcf5834f0a7f74bfd017c07da2411b35a4e2a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/50dd585bee7669eb165e5defcc35d17f3822cfbb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/51cfe54f815ae175c7d1126b983d4d7c89715004"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9f0ce5e162eed8b68345abe839c59768bc60f99a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d01337c0892d1509500c727edf81380777c2dd0f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc05ec97b8299e48e31367a9bc412c7e9c0e2b42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e022538e13dd1c82af5ec25ac28f12ca0ab26160"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()", "id": "2546398", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546398"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nInput: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()\nWhen chunking writes into SMBus blocks in rmi_smb_write_block(), the\nloop calculates block_len using the original total length (len) instead\nof the remaining length (cur_len).\nIf len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32\nfor every iteration, even on the final partial chunk where fewer than 32\nbytes remain. This causes smb_block_write() to read 32 bytes from the\nadvanced data buffer pointer, reading past the end of the input buffer.\nFix this by calculating block_len using cur_len and advancing the buffer\nand address pointers by block_len.", "A flaw was found in the Linux kernel's Synaptics RMI4 SMBus driver. When chunking write requests across the System Management Bus (SMBus), the driver miscalculates the remaining data length for the final block. A local user can exploit this issue to trigger an out-of-bounds read past the input buffer, leading to a kernel crash and Denial of Service (DoS) or the disclosure of sensitive memory."], "name": "CVE-2026-98204", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98204\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98204\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98204.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82264d0cf7aef2247563c031ff2ab96579d5d0cc,d01337c0892d1509500c727edf81380777c2dd0f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82264d0cf7aef2247563c031ff2ab96579d5d0cc,7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82264d0cf7aef2247563c031ff2ab96579d5d0cc,29fbcf5834f0a7f74bfd017c07da2411b35a4e2a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82264d0cf7aef2247563c031ff2ab96579d5d0cc,50dd585bee7669eb165e5defcc35d17f3822cfbb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82264d0cf7aef2247563c031ff2ab96579d5d0cc,e022538e13dd1c82af5ec25ac28f12ca0ab26160)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82264d0cf7aef2247563c031ff2ab96579d5d0cc,dc05ec97b8299e48e31367a9bc412c7e9c0e2b42)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82264d0cf7aef2247563c031ff2ab96579d5d0cc,9f0ce5e162eed8b68345abe839c59768bc60f99a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82264d0cf7aef2247563c031ff2ab96579d5d0cc,51cfe54f815ae175c7d1126b983d4d7c89715004)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T15:00:18.391879+00:00", "updated": "2026-10-09T14:45:07.353237+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}