Executive brief
A vulnerability was identified in the Linux kernel driver for the ADM1266 hardware monitoring chip, which is used to manage power supplies in various computing systems. A coding error allows the system to read and write memory outside of intended boundaries when checking the status of certain pins. This could potentially lead to system instability or a crash, affecting the reliability of the hardware monitoring functions.
Technical details
An out-of-bounds (OOB) read and write vulnerability exists in the Linux kernel's hwmon driver for the ADM1266 (pmbus/adm1266.c). The function adm1266_gpio_get_multiple() incorrectly uses the PMBus command code ADM1266_PDIO_STATUS (0xE9) as a loop limit instead of the actual number of PDIO pins (ADM1266_PDIO_NR). This causes the for_each_set_bit_from() macro to iterate significantly past the end of the 25-bit mask provided by gpiolib, reading up to 217 extra bits from the caller's stack. If any incidental bits are set in that memory range, the subsequent set_bit() call performs an OOB write to the bits array. The issue is resolved by capping the scan at the correct pin count. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel d98dfad35c38 to d0593e15fdeb56048a72c5c6e720f702759d0ccd
Timeline
- 2026-07-19: disclosed: CVE published and patches identified in stable trees.
References
- https://git.kernel.org/stable/c/17cee2f59029039416e8f6303050038eb59ba149
- https://git.kernel.org/stable/c/299efd14c2eda7e5fd40025e54addd4151a01081
- https://git.kernel.org/stable/c/2aef8f08c479f4cbc83e1e6b19d1c94d4dd24f17
- https://git.kernel.org/stable/c/4d1da9a6be5a8156c532d571c2ed237169f99244
- https://git.kernel.org/stable/c/b96c7f0bc0713dc6403912f6527d4ff9168d6fe6
- https://git.kernel.org/stable/c/d0593e15fdeb56048a72c5c6e720f702759d0ccd
- https://git.kernel.org/stable/c/d7834d92251baade796812876e95555e2066fa9f