From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B41823A7820 for ; Sun, 19 Jul 2026 15:43:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784475810; cv=none; b=bno82YmJMhGYfma3Lt4uvYUqjIK11GEaettpp3TluQTOFRRwzaDIoc7iupA/t2MAkXXSZD38JFPjTOAhOhp/VezMf+aT9YCb21HundGQ1TOEpdlRXam/P2KgDy2brljtedPh4/uuzy7PgHHqKP4LqQ1oWG/MvVeNTaIt/eyTzCI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784475810; c=relaxed/simple; bh=3JfiS7IzRQp6auQ+3DnCTnyPenpBlAqxL4Intdj4CFw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Muwmn59fRPFNWzJmuBFvcrfmnmjBLESKQmqlGNw8qvyDOHKz1sU/fmRQrfByoJyGfGYW0QDaFdH87WkCYlOd4odSIiVadqS/qs/zeg8ucStqrdjz9iUO+bDCG1a/qA4IJXFtEf7zJJgzYeP0OtG9OW1kkEriWdGWcfe85aqNvpA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=X0ZVFPo8; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="X0ZVFPo8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 05CD81F000E9; Sun, 19 Jul 2026 15:43:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784475809; bh=diXdOkrMraaHgdQNe5HJK3VddGcPUYbUO2s/LHSTYB0=; h=From:To:Cc:Subject:Date:Reply-To; b=X0ZVFPo8ZntMCTNdn0Kyy55yCIx45gT/nmWnQuwVubAZbaej1z8UyOAtuCF9xNzox W4T4TlvIqtAmovVUd7qeLGxLZgOYhPYtqOF4Af8peQdjjutOTP5zyVFZWMqZmvQKv9 WkBNSMfQ1tQa9WxDFAMkPke/wSOWXbPZkOeYwVQw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64085: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer Date: Sun, 19 Jul 2026 17:39:07 +0200 Message-ID: <2026071916-CVE-2026-64085-d28f@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4241; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=pHNCc72ecwvkbrvIlsSe/tYl4XnhPTS5dtdDr71u5ds=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkx7zO01fr9BHX3+9z2fclaMaPwboN0NofDysiq9ukL7 Fll2H52xLIwCDIxyIopsnzZxnN0f8UhRS9D29Mwc1iZQIYwcHEKwEQCpzEsOJm6qEVXvfm3V0yR Wrm40uKOLcovGeb7Fx1p+ft+9Vz+yuQze520td00Y/0A X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer adm1266_pmbus_block_xfer() copies the device-supplied block payload into the caller-provided buffer using the device-supplied length: memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]); The helper does not know how large data_r is and trusts the device to return at most one record's worth of bytes. adm1266_nvmem_read_blackbox() violates that contract: it advances read_buff inside data->dev_mem in ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns more than 64 bytes on the trailing record (read_buff offset 1984 in the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes before the post-call if (ret != ADM1266_BLACKBOX_SIZE) return -EIO; can reject the response. Contain the fix in the caller without changing the helper signature: read each record into a 255-byte local bounce buffer that matches the helper's maximum output, validate the returned length, and only then copy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot. The Linux kernel CVE team has assigned CVE-2026-64085 to this issue. Affected and fixed versions =========================== Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 5.10.258 with commit 7896d87cbb05e097efc113243d4e38f9f8cea16c Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 5.15.209 with commit 9d5309500b4607b7198e19f0a3fa13eb864cd5fb Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 6.1.175 with commit 6098634cfa711f11a8d65368dc51ec8f7c8241ba Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 6.6.142 with commit 60c4b9fe1a3dd012014b1f561a6928a0b5db1126 Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 6.12.92 with commit 83e039f0a43e0708515b0479cb7690fb93faaaa0 Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 6.18.34 with commit 97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 7.0.11 with commit dd47b8c4a0a8ced442da3f008db28fbbd31feaf0 Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 7.1 with commit 43cae21424ff8e33894a0f86c6b80b840c049fd7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64085 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/hwmon/pmbus/adm1266.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/7896d87cbb05e097efc113243d4e38f9f8cea16c https://git.kernel.org/stable/c/9d5309500b4607b7198e19f0a3fa13eb864cd5fb https://git.kernel.org/stable/c/6098634cfa711f11a8d65368dc51ec8f7c8241ba https://git.kernel.org/stable/c/60c4b9fe1a3dd012014b1f561a6928a0b5db1126 https://git.kernel.org/stable/c/83e039f0a43e0708515b0479cb7690fb93faaaa0 https://git.kernel.org/stable/c/97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f https://git.kernel.org/stable/c/dd47b8c4a0a8ced442da3f008db28fbbd31feaf0 https://git.kernel.org/stable/c/43cae21424ff8e33894a0f86c6b80b840c049fd7