A high-severity memory corruption vulnerability in the Linux kernel allows a local authenticated attacker to potentially achieve arbitrary code execution or system instability by exploiting an out-of-bounds read.

The vulnerability is an out-of-bounds read flaw within the w1_f19_i2c_master_transfer function of the DS28E17 driver. An attacker with local access can supply an oversized length byte during an I2C block read, causing the driver to read data beyond the allocated buffer limit.

The exploitation of this flaw could lead to a complete compromise of system integrity and availability. Because the vulnerability resides within the kernel, successful exploitation allows an attacker to elevate privileges or cause a kernel panic, resulting in significant service disruption and unauthorized access to sensitive memory regions. Given the CVSS score of 7.8, this poses a substantial risk to any environment relying on Linux-based infrastructure, particularly those utilizing 1-Wire bridge hardware.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel-related errors or crashes that may indicate attempted exploitation of driver-level memory corruption.

Compensating Controls: Restrict access to the physical or virtual interfaces that interact with the DS28E17 bridge device to only trusted users or processes.

Public Exploit Available: exploit_available (false)

This vulnerability represents a critical risk to system stability and security due to its location in the kernel. Administrators should prioritize patching the kernel across all affected environments as soon as vendor-supplied updates become available. Failure to apply these updates leaves the system vulnerable to local privilege escalation and potential service denial.