CVE-2024-26593 – A vulnerability in the Linux kernel's i2c-i801 ... (How to Fix)

Q: What is the severity of CVE-2024-26593?

CVE-2024-26593 has a CVSS score of 7.1 (HIGH). A vulnerability in the Linux kernel's i2c-i801 driver allows improper memory access during block process call transactions. Attackers could read sensitive data from kernel memory or cause system instability. Systems using Intel I2C/SMBus controllers with the affected driver are vulnerable.

📋 TL;DR

A vulnerability in the Linux kernel's i2c-i801 driver allows improper memory access during block process call transactions. Attackers could read sensitive data from kernel memory or cause system instability. Systems using Intel I2C/SMBus controllers with the affected driver are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions with vulnerable i2c-i801 driver (specific commit ranges in references)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires Intel I2C/SMBus controller hardware and i2c-i801 driver usage

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory disclosure leading to privilege escalation, sensitive data exposure, or system crash/DoS

🟠

Likely Case

Information disclosure of kernel memory contents, potentially exposing sensitive data or causing system instability

🟢

If Mitigated

Limited impact due to required local access and specific hardware configuration

🌐 Internet-Facing: LOW - Requires local system access, not remotely exploitable

🏢 Internal Only: MEDIUM - Local attackers could exploit this to read kernel memory or cause DoS

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and knowledge of I2C/SMBus operations

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits: 1f8d0691c50581ba6043f009ec9e8b9f78f09d5a, 491528935c9c48bf341d8b40eabc6c4fc5df6f2c, 609c7c1cc976e740d0fed4dbeec688b3ecb5dce2, 6be99c51829b24c914cef5bff6164877178e84d9, 7a14b8a477b88607d157c24aeb23e7389ec3319f

Vendor Advisory: https://git.kernel.org/stable/c/

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version 2. Reboot system 3. Verify kernel version with 'uname -r'

🔧 Temporary Workarounds

Disable i2c-i801 module

linux

Blacklist or disable the vulnerable i2c-i801 driver module

echo 'blacklist i2c_i801' >> /etc/modprobe.d/blacklist-i2c-i801.conf
rmmod i2c_i801

🧯 If You Can't Patch

Restrict local access to trusted users only
Monitor for unusual I2C/SMBus activity or system crashes

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if i2c_i801 module is loaded: 'lsmod | grep i2c_i801' and 'uname -r'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and i2c_i801 module loads without errors

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
I2C/SMBus error logs
System crash reports

Network Indicators:

Not applicable - local vulnerability

SIEM Query:

Search for: kernel panic, oops, i2c_i801 errors in system logs

📊 Metadata

CVE ID: CVE-2024-26593

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

Published: February 23, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-26593, you might also want to check these: