Executive brief
A vulnerability was identified in the Linux kernel's hardware monitoring driver for the ADM1266 power management chip. This flaw could allow a local attacker to cause a system crash or potentially access restricted memory by sending a specific data request that exceeds the allocated buffer size. This affects systems using this specific hardware component for power monitoring and sequencing.
Technical details
A buffer overflow exists in the adm1266_pmbus_block_xfer() function within drivers/hwmon/pmbus/adm1266.c. The driver allocates a buffer (read_buf) of size ADM1266_PMBUS_BLOCK_MAX + 1 (256 bytes) but configures I2C transactions to read up to ADM1266_PMBUS_BLOCK_MAX + 2 (257 bytes) to account for the length byte, payload, and Packet Error Checking (PEC) byte. When a maximum-length block response is received, the I2C controller writes one byte past the end of the buffer. Additionally, the subsequent PEC validation logic performs an out-of-bounds read. This can lead to memory corruption or a kernel oops. The issue has been resolved by increasing the buffer size to accommodate the PEC byte.
Affected products
- Linux Linux 407dc802a9c0 to 487566cb1ccdf3756fdd7bf8d875e612ff3169bb
Timeline
- 2026-05-15: disclosed: Vulnerability reported by Abdurrahman Hussain
- 2026-06-01: patched: Fix merged into various stable kernel branches
- 2026-07-19: advisory: CVE-2026-64086 published
References
- https://git.kernel.org/stable/c/2279c342d94eca225bf9f301c8806a05a1c81619
- https://git.kernel.org/stable/c/397d3f523bfff2f4e3dacf9b1339bd76dc207f78
- https://git.kernel.org/stable/c/472744f69d25a2d5111ad62f1d62579dce2c13c8
- https://git.kernel.org/stable/c/487566cb1ccdf3756fdd7bf8d875e612ff3169bb
- https://git.kernel.org/stable/c/528a9f88e88502d0c2f2052a279415074cd83715
- https://git.kernel.org/stable/c/a6c802145a8de0830bca803c6d415f7e9e683624
- https://git.kernel.org/stable/c/bd5be3fa5de6dbf61f1b3cec6b79c2c2f8065694