LiveActive security incident?Get immediate response
CVE Record

CVE-2021-46934: i2c: validate user data in compat ioctl

In the Linux kernel, the following vulnerability has been resolved: i2c: validate user data in compat ioctl Wrong user data may cause warning in i2c_transfer(), ex: zero msgs. Userspace should not be able to trigger warnings, so this patch adds validation checks for user data in compact ioctl to prevent reported warnings

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-46934 is a Linux kernel input-validation issue in the I2C compat ioctl path. Bad user-supplied data, such as a zero-message transfer, could trigger kernel warnings in i2c_transfer(). The sources describe warning prevention, not data theft, privilege escalation, or remote compromise.

Executive priority

Treat this as a routine kernel hygiene item unless affected systems expose I2C interfaces to untrusted local users. Prioritize normal patch cycles and confirm vendor fix coverage. Current evidence does not support emergency response.

Technical view

The fix adds validation before the compat ioctl passes user-controlled I2C message data into i2c_transfer(). The CVE record says userspace should not be able to trigger warnings, and the stable references are kernel commits resolving that validation gap. No CVSS, CWE, or detailed impact metrics are provided.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions with access to the relevant I2C compat ioctl path. The CVE data lists affected Linux versions including 4.15, 4.19.224, 5.4.170, 5.10.90, 5.15.13, and 5.16, but distro backport status must be verified separately.

Exploitation context

The bundle does not report active exploitation, public exploit availability, or KEV listing. The described trigger is local userspace-provided ioctl data causing kernel warnings. There is insufficient evidence to claim remote exploitation or higher-impact outcomes.

Researcher notes

The public data is sparse: no CVSS, CWE, exploit status, or detailed impact analysis. Analysis should focus on affected kernel lineage, compat ioctl reachability, and whether local users can reach I2C device nodes. The source version list contains an ambiguous 0 entry.

Mitigation direction

  • Check distribution kernel advisories for CVE-2021-46934 backport status.
  • Update to a kernel build containing the referenced stable fixes.
  • Restrict unnecessary local access to I2C device interfaces where operationally feasible.
  • Track vendor guidance because the bundle provides no separate workaround.

Validation and detection

  • Inventory Linux kernel versions on systems with I2C device exposure.
  • Confirm whether vendor kernel changelogs include the referenced stable commits.
  • Review device permissions for I2C interfaces available to local users.
  • Monitor kernel logs for recurring I2C transfer warnings.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-46934 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7d5cb45655f2e9e37ef75d18f50c0072ef14a38b, 7d5cb45655f2e9e37ef75d18f50c0072ef14a38b, 7d5cb45655f2e9e37ef75d18f50c0072ef14a38b, 7d5cb45655f2e9e37ef75d18f50c0072ef14a38b, 7d5cb45655f2e9e37ef75d18f50c0072ef14a38bunaffected
LinuxLinux4.15, 0, 4.19.224, 5.4.170, 5.10.90, 5.15.13, 5.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.