CVE-2026-64084

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel hwmon ADM1266 Driver

Publication date: 2026-07-19

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) { ... } where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR = 25. gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip), so the iteration walks find_next_bit() up to 242, reading up to 217 extra bits (a handful of unsigned-long words: four on 64-bit, seven on 32-bit) of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds. Substitute ADM1266_PDIO_NR for the constant so the scan stops at the last real PDIO bit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-09-03

Generated

2026-09-19

AI Q&A

2026-07-19

EPSS Evaluated

2026-09-15

NVD

CVE-2026-64084

EUVD

EUVD-2026-45657

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)
linux	linux_kernel	From 5.10 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's hwmon subsystem, specifically affecting the adm1266 driver for PMBus devices. It involves a bounds-checking error in the adm1266_gpio_get_multiple() function where the code incorrectly uses a PMBus command code (0xE9) instead of the actual number of PDIO pins (ADM1266_PDIO_NR) as the upper bound for iterating over GPIO bits. This causes the function to read and write beyond the intended memory area.

Detection Guidance

This vulnerability is specific to the Linux kernel's hwmon subsystem for the ADM1266 PMBus device. Detection requires checking kernel version and affected driver. Use uname -a to check kernel version and grep adm1266 /proc/kallsyms to verify if the vulnerable function is present.

Impact Analysis

This vulnerability could allow an attacker with local access to cause memory corruption, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It may also expose sensitive data if memory beyond the intended buffer is read.

Compliance Impact

This vulnerability involves a buffer overflow in the Linux kernel's hwmon subsystem for the ADM1266 PMBus device. It does not directly relate to data privacy, security controls, or compliance requirements under standards like GDPR or HIPAA. The issue is limited to memory corruption in kernel memory during GPIO operations.

Mitigation Strategies

Apply the latest kernel patch from your distribution that fixes CVE-2026-64084. If no patch is available, consider disabling the adm1266 kernel module temporarily using modprobe -r adm1266 until an update is applied.

Hi! I’m here to help you understand CVE-2026-64084. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70