Executive brief
A vulnerability in the Linux kernel's hardware monitoring driver for ADM1266 devices could allow a malicious or faulty hardware device to crash the system. The driver incorrectly trusts the data length reported by the device when reading 'blackbox' diagnostic records, leading to a memory overflow. This could result in a system crash or unpredictable behavior when the operating system interacts with the hardware.
Technical details
A buffer overflow exists in the ADM1266 pmbus driver within the Linux kernel. The function adm1266_pmbus_block_xfer() performs a memcpy using a length provided directly by the hardware device without verifying it against the destination buffer size. Specifically, adm1266_nvmem_read_blackbox() expects 64-byte records, but the underlying helper can write up to 255 bytes. A device returning more than 64 bytes on a trailing record can overflow the 2048-byte dev_mem allocation by up to 191 bytes. This is resolved by implementing a 255-byte bounce buffer to safely capture and validate the transfer before copying it to the final destination.
Affected products
- Linux Linux 407dc802a9c0809ca6a48de4b4c63305eb84ef56 to 7896d87cbb05e097efc113243d4e38f9f8cea16c
Timeline
- 2026-05-15: other: Patch submitted by developer
- 2026-07-19: advisory: CVE published
References
- https://git.kernel.org/stable/c/43cae21424ff8e33894a0f86c6b80b840c049fd7
- https://git.kernel.org/stable/c/6098634cfa711f11a8d65368dc51ec8f7c8241ba
- https://git.kernel.org/stable/c/60c4b9fe1a3dd012014b1f561a6928a0b5db1126
- https://git.kernel.org/stable/c/7896d87cbb05e097efc113243d4e38f9f8cea16c
- https://git.kernel.org/stable/c/83e039f0a43e0708515b0479cb7690fb93faaaa0
- https://git.kernel.org/stable/c/97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f
- https://git.kernel.org/stable/c/9d5309500b4607b7198e19f0a3fa13eb864cd5fb