CVE-2026-64083

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors

adm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the

pin-status word as

pins_status = read_buf[0] + (read_buf[1] << 8);

right after i2c_smbus_read_block_data(), guarding only against an

error return. A well-behaved device returns 2 bytes for

GPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or

1-byte response too. If the device returns 0 bytes, both read_buf

slots are uninitialized stack memory; if it returns 1 byte, read_buf[1]

is.

The composed value then flows through set_bit() into the caller's

*bits in adm1266_gpio_get_multiple(), or into the return value of

adm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and

the char-dev ioctls). That leaks a few bits of kernel stack per

request on any device whose firmware glitch, bus error, or hostile

slave produces a short block-read response.

Add t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References