Executive brief
A vulnerability in the Linux kernel's hardware monitoring driver for ADM1266 devices could allow a system crash or memory corruption. This occurs when the system reads diagnostic 'blackbox' data from the hardware; if the hardware provides malformed information, the driver may write data beyond its assigned memory limits. This could lead to system instability or potentially allow an attacker with local access to compromise the operating system.
Technical details
An out-of-bounds write vulnerability exists in the adm1266_nvmem_read_blackbox() function within drivers/hwmon/pmbus/adm1266.c. The driver fails to validate the 'record_count' value retrieved from byte 3 of the BLACKBOX_INFO response before using it as a loop limit. If the device returns a value greater than 32 (the maximum expected records), the driver will write data past the end of the 2048-byte 'dev_mem' buffer. This can be triggered by faulty firmware, bus corruption, or a malicious/non-responsive device. The fix introduces a cap at ADM1266_BLACKBOX_MAX_RECORDS and returns an I/O error if exceeded.
Affected products
- Linux Linux 15609d189302 to adcb163ad7cacca317872fc62bd8885e842e45e3
Timeline
- 2026-05-15: other: Vulnerability fixed in source code by Abdurrahman Hussain
- 2026-07-19: disclosed: CVE-2026-64087 published
References
- https://git.kernel.org/stable/c/0e791cd0140fb136083565aadfbe0f705aa260d0
- https://git.kernel.org/stable/c/231db52a5b64d0a9769e298dadc148e1f79b26a6
- https://git.kernel.org/stable/c/4afca954622d672ea65ed961bed01cf91caa034e
- https://git.kernel.org/stable/c/5469e1e7c411acc15fdd8262c99c3ebd9defd594
- https://git.kernel.org/stable/c/75c862adf3d3caab4f49bb3530723c215376e37c
- https://git.kernel.org/stable/c/adcb163ad7cacca317872fc62bd8885e842e45e3
- https://git.kernel.org/stable/c/c2c56092710fe8a893b67b5a3d7e62808d02d84d