CVE-2026-64087
Received Received - Intake

Buffer Overflow in ADM1266 hwmon Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) reject implausible blackbox record_count adm1266_nvmem_read_blackbox() loops over a record_count that comes straight from byte 3 of the BLACKBOX_INFO response. The destination buffer is data->dev_mem, sized for the nvmem cell's declared 2048 bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE = 32 * 64). A device that reports a record_count greater than 32 -- whether due to firmware bugs, bus corruption, or a non-responsive slave returning 0xff -- would walk read_buff past the end of the dev_mem allocation on the trailing iterations. Cap record_count at ADM1266_BLACKBOX_MAX_RECORDS (introduced here) before entering the loop and return -EIO on any larger value, so a malformed BLACKBOX_INFO response cannot drive the loop out of bounds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64087
EUVD
EUVD-2026-45772

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's hwmon subsystem, specifically in the pmbus/adm1266 driver. It involves a buffer overflow issue where a device's reported record_count value is not properly validated. The function adm1266_nvmem_read_blackbox() uses this record_count to loop through data, but if the value exceeds the allocated buffer size (32 records), it can cause memory corruption by reading past the end of the buffer.

Detection Guidance

This vulnerability affects the Linux kernel's hwmon subsystem, specifically the pmbus/adm1266 driver. Detection requires checking if the system uses affected kernel versions and the adm1266 hardware. Inspect kernel logs for errors related to pmbus or adm1266. Commands like dmesg | grep adm1266 or journalctl -k | grep adm1266 may help identify issues.

Impact Analysis

This vulnerability could allow an attacker with access to the affected system to cause a denial of service or potentially execute arbitrary code with kernel privileges. It may lead to system crashes, data corruption, or unauthorized access depending on the attacker's capabilities and system configuration.

Compliance Impact

This vulnerability is a memory corruption issue in the Linux kernel's hwmon subsystem affecting the adm1266 driver. It does not directly relate to data privacy, security controls, or compliance requirements under standards like GDPR or HIPAA. The issue involves improper bounds checking leading to potential buffer overflows, which could cause system instability or crashes but does not inherently violate compliance mandates.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-64087. If using a custom kernel, apply the patch that caps record_count at ADM1266_BLACKBOX_MAX_RECORDS. Disable or unload the adm1266 driver if not needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64087. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart