{
  "cveId": "CVE-2025-39928",
  "url": "https://patchblox.com/security/cve/CVE-2025-39928",
  "summary": "CVE-2025-39928 is fixed in linux on 1 platform by DEBIAN-CVE-2025-39928 (version 6.16.8-1), released October 1, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  i2c: rtl9300: ensure data length is within suppo...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  i2c: rtl9300: ensure data length is within supported range  Add an explicit check for the xfer length to \u0027rtl9300_i2c_config_xfer\u0027 to ensure the data length isn\u0027t within the supported range. In particular a data length of 0 is not supported by the hardware and causes unintended or destructive behaviour.  This limitation becomes obvious when looking at the register documentation [1]. 4 bits are reserved for DATA_WIDTH and the value of these 4 bits is used as N \u002B 1, allowing a data length range of 1 \u003C= len \u003C= 16.  Affected by this is the SMBus Quick Operation which works with a data length of 0. Passing 0 as the length causes an underflow of the value due to:  (len - 1) \u0026 0xf  and effectively specifying a transfer length of 16 via the registers. This causes a 16-byte write operation instead of a Quick Write. For example, on SFP modules without write-protected EEPROM this soft-bricks them by overwriting some initial bytes.  For completeness, also add a quirk for the zero length.  [1] https://svanheule.net/realtek/longan/register/i2c_mst1_ctrl2",
  "published": "2025-10-01T08:15:36Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00134,
  "epssPercentile": 0.02937,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.16.8-1",
      "fix": "DEBIAN-CVE-2025-39928",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-39928",
      "released": "2025-10-01T08:15:36Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}