CVE-2026-64087

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) reject implausible blackbox record_count

adm1266_nvmem_read_blackbox() loops over a record_count that comes

straight from byte 3 of the BLACKBOX_INFO response. The destination

buffer is data->dev_mem, sized for the nvmem cell's declared 2048

bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE = 32 * 64).

A device that reports a record_count greater than 32 -- whether due

to firmware bugs, bus corruption, or a non-responsive slave returning

0xff -- would walk read_buff past the end of the dev_mem allocation

on the trailing iterations.

Cap record_count at ADM1266_BLACKBOX_MAX_RECORDS (introduced here)

before entering the loop and return -EIO on any larger value, so a

malformed BLACKBOX_INFO response cannot drive the loop out of bounds.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References