Executive brief
A vulnerability in the Linux kernel's hardware monitoring driver for ADM1266 devices could allow a connected hardware component to crash the system. By sending more data than expected during a diagnostic 'blackbox' read, a device can trigger a memory overflow. This could lead to system instability or a denial-of-service condition on affected Linux machines.
Technical details
A stack-based buffer overflow exists in the adm1266_nvmem_read_blackbox() function within the drivers/hwmon/pmbus/adm1266.c component of the Linux kernel. The function allocates a 5-byte buffer for BLACKBOX_INFO responses but passes it to i2c_smbus_read_block_data(), which performs a memcpy() based on the length byte provided by the hardware device (up to 32 bytes) without validating the destination buffer size. An attacker with the ability to provide malicious SMBus responses (e.g., via a compromised or malicious peripheral) can overflow the stack buffer. This can lead to a kernel panic or potentially arbitrary code execution. The issue has been resolved by widening the buffer to I2C_SMBUS_BLOCK_MAX.
Affected products
- Linux Linux Kernel 15609d189302 to 33251abb9c9dd62943be76f0427c5527ee39188f
Timeline
- 2026-05-15: disclosed: Vulnerability reported by Abdurrahman Hussain
- 2026-06-01: patched: Fix committed to stable kernel trees
- 2026-07-19: advisory: CVE-2026-64135 published
References
- https://git.kernel.org/stable/c/0dbf64c502443c08c2e28a77ecbfcc5479d93228
- https://git.kernel.org/stable/c/2b7a698d5093b548c464828d984f05ced5f3fd2a
- https://git.kernel.org/stable/c/33251abb9c9dd62943be76f0427c5527ee39188f
- https://git.kernel.org/stable/c/6ed16a40b162e9d87d9ac8bed4d7f0e3e807700e
- https://git.kernel.org/stable/c/7f705e581ef3e6bb308a121a89adf5237d968204
- https://git.kernel.org/stable/c/ba09f4baa5bd96c5d26c942defa546a72dbbe5bf
- https://git.kernel.org/stable/c/ca560f7566df7e2826c2999e959e6b94eb938f76