CVE-2026-64085

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer

adm1266_pmbus_block_xfer() copies the device-supplied block payload

into the caller-provided buffer using the device-supplied length:

memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]);

The helper does not know how large data_r is and trusts the device to

return at most one record's worth of bytes. adm1266_nvmem_read_blackbox()

violates that contract: it advances read_buff inside data->dev_mem in

ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to

write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns

more than 64 bytes on the trailing record (read_buff offset 1984 in

the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes

before the post-call

if (ret != ADM1266_BLACKBOX_SIZE)

return -EIO;

can reject the response.

Contain the fix in the caller without changing the helper signature:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References