Listen to this Post
This vulnerability exists within the `intel_quicki2c` kernel module for Intel HID devices. The driver retrieves ICRS and ISUB configuration data from the ACPI _DSD (Device Specific Data) methods. The ACPI tables return these data buffers with a trailing byte, making their actual length one byte longer than the fixed-size `quicki2c_subip_acpi_parameter` and `quicki2c_subip_acpi_config` structures defined in the driver. When the driver performs a `memcpy()` to copy the ACPI buffer into the smaller stack-allocated struct, it writes past the allocated memory boundary, causing a stack-out-of-bounds write. This corrupts adjacent stack data and leads to a kernel crash (Denial of Service) and could potentially allow for local privilege escalation.
Platform: Linux Kernel
Version: 6.16.0+
Vulnerability: Stack buffer overflow
Severity: Critical
date: 09/16/2025
Prediction: 10/2025
What Undercode Say:
$ uname -r 6.16.0-rc3+ $ cat /sys/class/dmi/id/chassis_vendor | grep -i "Intel" $ dmesg | grep -i "kasan: stack-out-of-bounds"
// Potential trigger path quicki2c_get_acpi_resources() -> quicki2c_acpi_get_dsd_property() -> memcpy(&i2c_param, buffer, sizeof(buffer)); // Overflow
How Exploit:
Local kernel panic/DoS.
Protection from this CVE
Update kernel version.
Impact:
System crash, potential LPE.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
