Executive brief
The adm1275 hardware monitoring driver in the Linux kernel contains a flaw where a stack buffer used to read device model names is not initialized before use. An attacker with local access to trigger device probing could potentially read sensitive uninitialized stack memory, compromising confidentiality of kernel memory contents.
Technical details
The vulnerability is an information disclosure issue in the adm1275_probe() function in drivers/hwmon/pmbus/adm1275.c. The vulnerable code calls i2c_smbus_read_block_data() to read up to 32 bytes into an uninitialized stack array (block_buffer) without null termination, then passes the result to strncasecmp() for device name comparison. If the device returns a shorter string than expected (e.g., "adm12" vs "adm1275"), strncasecmp() continues reading into uninitialized stack memory beyond the valid returned bytes. The attack requires local access and ability to interact with or probe the device. The fix initializes the stack array to zero before use (u8 block_buffer[I2C_SMBUS_BLOCK_MAX + 1] = {0}).
Affected products
- Linux Linux Kernel affected versions include Linux 4.x through 6.x (all stable branches)
Timeline
- 2026-08-15: disclosed
- 2026-06-26: patched: Upstream fix committed by Matti Vaittinen