CVE-2026-64135

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX

adm1266_nvmem_read_blackbox() declares a 5-byte stack buffer and

passes it to i2c_smbus_read_block_data() to retrieve the 4-byte

BLACKBOX_INFO response. i2c_smbus_read_block_data() does not honour

caller buffer sizes -- it memcpy()s data.block[0] bytes from the

SMBus transaction (where data.block[0] is the length byte returned by

the slave device, up to I2C_SMBUS_BLOCK_MAX = 32):

memcpy(values, &data.block[1], data.block[0]);

If the device returns any block length above 5, the call overflows

the caller's 5-byte stack buffer before the post-call

if (ret != 4)

return -EIO;

check has a chance to reject the response.

Widen the local buffer to I2C_SMBUS_BLOCK_MAX so the helper has room

for any well-formed SMBus block response, matching the convention used

by the other i2c_smbus_read_block_data() callers in this driver.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References