CVE-2026-98204

What it actually does

Out-of-bounds read triggered when rmi_smb_write_block chunks SMBus writes larger than 32 bytes; block_len is computed from the original total length instead of remaining bytes, causing smb_block_write to read 32 bytes past the end of the source buffer on the final partial chunk.

Why it matters to the business

Potential information disclosure or system instability on Linux devices using RMI4 touchpads or similar SMBus input hardware; unpatched kernels remain exposed until updated.

How an attack unfolds

An attacker with the ability to submit a write larger than SMB_MAX_COUNT to the rmi_smbus driver (via local input device interaction or a malicious userspace process) triggers repeated 32-byte reads that advance past the legitimate buffer, reading adjacent kernel memory.

How to fix it

Apply the upstream fix that calculates block_len from cur_len and correctly advances buffer and address pointers; rebuild and deploy the patched kernel to all affected systems.

How to confirm the fix worked

Confirm the corrected code path is present by inspecting the rmi_smb_write_block function for use of cur_len in block_len computation and pointer advancement; test with writes larger than 32 bytes to verify no out-of-bounds access occurs.

Typical attack path

1. Obtain local access or execute code capable of writing to the affected input device path
2. Craft a multi-chunk SMBus write request exceeding 32 bytes
3. Trigger rmi_smb_write_block so the final partial chunk uses the incorrect block_len
4. Read the leaked kernel memory via the resulting out-of-bounds access

How to detect it

Review kernel logs for oops or panic messages referencing rmi_smb_write_block or smb_block_write; inspect audit logs for unusual write patterns to /dev/input or SMBus device nodes.

What your security team should do

• Prioritize kernel updates on systems exposing RMI SMBus input devices
• Monitor vendor advisories for backported fixes in supported distributions
• Restrict unprivileged access to input device nodes until patches are applied