CVE-2026-64084

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR

adm1266_gpio_get_multiple() iterates the PDIO portion of the

caller-supplied mask using

for_each_set_bit_from(gpio_nr, mask,

ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) {

...

}

where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233),

not the number of PDIO pins. The intended upper bound is

ADM1266_GPIO_NR + ADM1266_PDIO_NR = 25.

gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip),

so the iteration walks find_next_bit() up to 242, reading up to 217

extra bits (a handful of unsigned-long words: four on 64-bit, seven

on 32-bit) of whatever lives past the end of the mask in the

caller's stack. Any incidental set bit in that range then drives a

set_bit(gpio_nr, bits) call that writes past the end of the

caller-supplied bits array too -- both out-of-bounds.

Substitute ADM1266_PDIO_NR for the constant so the sc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References