From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-64085: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
Date: Sun, 19 Jul 2026 17:39:07 +0200 [thread overview]
Message-ID: <2026071916-CVE-2026-64085-d28f@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
adm1266_pmbus_block_xfer() copies the device-supplied block payload
into the caller-provided buffer using the device-supplied length:
memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]);
The helper does not know how large data_r is and trusts the device to
return at most one record's worth of bytes. adm1266_nvmem_read_blackbox()
violates that contract: it advances read_buff inside data->dev_mem in
ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to
write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns
more than 64 bytes on the trailing record (read_buff offset 1984 in
the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes
before the post-call
if (ret != ADM1266_BLACKBOX_SIZE)
return -EIO;
can reject the response.
Contain the fix in the caller without changing the helper signature:
read each record into a 255-byte local bounce buffer that matches the
helper's maximum output, validate the returned length, and only then
copy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot.
The Linux kernel CVE team has assigned CVE-2026-64085 to this issue.
Affected and fixed versions
===========================
Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 5.10.258 with commit 7896d87cbb05e097efc113243d4e38f9f8cea16c
Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 5.15.209 with commit 9d5309500b4607b7198e19f0a3fa13eb864cd5fb
Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 6.1.175 with commit 6098634cfa711f11a8d65368dc51ec8f7c8241ba
Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 6.6.142 with commit 60c4b9fe1a3dd012014b1f561a6928a0b5db1126
Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 6.12.92 with commit 83e039f0a43e0708515b0479cb7690fb93faaaa0
Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 6.18.34 with commit 97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f
Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 7.0.11 with commit dd47b8c4a0a8ced442da3f008db28fbbd31feaf0
Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 7.1 with commit 43cae21424ff8e33894a0f86c6b80b840c049fd7
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-64085
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/hwmon/pmbus/adm1266.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/7896d87cbb05e097efc113243d4e38f9f8cea16c
https://git.kernel.org/stable/c/9d5309500b4607b7198e19f0a3fa13eb864cd5fb
https://git.kernel.org/stable/c/6098634cfa711f11a8d65368dc51ec8f7c8241ba
https://git.kernel.org/stable/c/60c4b9fe1a3dd012014b1f561a6928a0b5db1126
https://git.kernel.org/stable/c/83e039f0a43e0708515b0479cb7690fb93faaaa0
https://git.kernel.org/stable/c/97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f
https://git.kernel.org/stable/c/dd47b8c4a0a8ced442da3f008db28fbbd31feaf0
https://git.kernel.org/stable/c/43cae21424ff8e33894a0f86c6b80b840c049fd7
reply other threads:[~2026-07-19 15:43 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026071916-CVE-2026-64085-d28f@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox