CVE-2022-50131

HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()

State: Published
Severity: 7.8 High
Published: Jun 18, 2025
Updated: Aug 5, 2026
Reserved: Jun 18, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()

Smatch Warning: drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() '&mcp->txbuf[5]' too small (59 vs 255) drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() 'buf' too small (34 vs 255)

The 'len' variable can take a value between 0-255 as it can come from data->block[0] and it is user data. So add an bound check to prevent a buffer overflow in memcpy().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	67a95c21463d066060b0f66d65a75d45bb386ffb to before 66c8e816f2f2ca4a61b406503bd10bad1b35f72fAffected 67a95c21463d066060b0f66d65a75d45bb386ffb to before 91443c669d280937968f0aa4edefa741cfe35314Affected 67a95c21463d066060b0f66d65a75d45bb386ffb to before 6402116a7b5ec80fa40fd145a80c813019cd555fAffected 67a95c21463d066060b0f66d65a75d45bb386ffb to before 3c0f8a59f2cc8841ee6653399a77f4f3e6e9a270Affected 67a95c21463d066060b0f66d65a75d45bb386ffb to before 62ac2473553a00229e67bdf3cb023b62cf7f5a9aAffected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.137 through 5.10.Not affected 5.15.61 through 5.15.Not affected 5.18.18 through 5.18.Not affected 5.19.2 through 5.19.Not affected 6.0 and laterNot affected

Product

Versions

LinuxLinux

67a95c21463d066060b0f66d65a75d45bb386ffb to before 66c8e816f2f2ca4a61b406503bd10bad1b35f72fAffected
67a95c21463d066060b0f66d65a75d45bb386ffb to before 91443c669d280937968f0aa4edefa741cfe35314Affected
67a95c21463d066060b0f66d65a75d45bb386ffb to before 6402116a7b5ec80fa40fd145a80c813019cd555fAffected
67a95c21463d066060b0f66d65a75d45bb386ffb to before 3c0f8a59f2cc8841ee6653399a77f4f3e6e9a270Affected
67a95c21463d066060b0f66d65a75d45bb386ffb to before 62ac2473553a00229e67bdf3cb023b62cf7f5a9aAffected

LinuxLinux

5.7Affected
before 5.7Not affected
5.10.137 through 5.10.*Not affected
5.15.61 through 5.15.*Not affected
5.18.18 through 5.18.*Not affected
5.19.2 through 5.19.*Not affected
6.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.