LiveActive security incident?Get immediate response
CVE Record

CVE-2026-64085: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer adm1266_pmbus_block_xfer() copies the device-supplied block payload into the caller-provided buffer using the device-supplied length: memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]); The helper does not know how large data_r is and trusts the device to return at most one record's worth of bytes. adm1266_nvmem_read_blackbox() violates that contract: it advances read_buff inside data->dev_mem in ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns more than 64 bytes on the trailing record (read_buff offset 1984 in the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes before the post-call if (ret != ADM1266_BLACKBOX_SIZE) return -EIO; can reject the response. Contain the fix in the caller without changing the helper signature: read each record into a 255-byte local bounce buffer that matches the helper's maximum output, validate the returned length, and only then copy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A Linux kernel hardware-monitoring driver for the ADM1266 can copy too much data from the device into a smaller memory area. A faulty or malicious device response could corrupt kernel memory. The source does not provide CVSS, CWE, known exploitation, or business-impact specifics, so urgency depends on whether affected systems actually use this driver and hardware.

Executive priority

Prioritize targeted assessment over broad emergency action. Patch affected embedded, hardware-management, lab, or infrastructure systems that use ADM1266 monitoring. For ordinary Linux fleets without this hardware path, business risk is probably limited, but evidence is incomplete because no CVSS or exploitation details were provided.

Technical view

The flaw is in hwmon pmbus/adm1266 blackbox reads. A helper copies a device-supplied block length into a caller buffer, while the caller advances through 64-byte slots in a 2048-byte allocation. A response up to 255 bytes can overflow the final slot by up to 191 bytes before length validation rejects it.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with the ADM1266 PMBus hwmon driver enabled and relevant hardware reachable. General Linux servers without this driver or device are unlikely to be exposed based on the provided sources.

Exploitation context

The bundle does not show CISA KEV listing, public exploitation, exploit code, or remote attack evidence. Exploitation would require influencing the ADM1266 device response path or interacting with affected hardware in a way the kernel driver processes.

Researcher notes

The fix uses a protocol-sized 255-byte bounce buffer, validates the returned length, then copies exactly 64 bytes into the destination slot. The key research question is whether any reachable or compromised device path can reliably return oversized block data to the driver.

Mitigation direction

  • Update to a Linux kernel or vendor kernel package containing the referenced stable fixes.
  • Check distribution advisories for backported fixes before assuming version numbers are safe.
  • Disable or avoid loading the adm1266 driver where the hardware is not required.
  • Limit exposure to untrusted or tampered PMBus/I2C hardware in affected environments.

Validation and detection

  • Inventory systems for affected Linux kernel versions listed in the CVE source bundle.
  • Confirm whether the ADM1266 PMBus hwmon driver is built, loadable, or loaded.
  • Identify hosts with ADM1266-compatible hardware or PMBus paths using this driver.
  • Verify installed kernel source or changelog includes one of the cited stable commits.
  • Track vendor advisory status if using distribution-maintained kernels with backports.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-64085 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux407dc802a9c0809ca6a48de4b4c63305eb84ef56, 407dc802a9c0809ca6a48de4b4c63305eb84ef56, 407dc802a9c0809ca6a48de4b4c63305eb84ef56, 407dc802a9c0809ca6a48de4b4c63305eb84ef56, 407dc802a9c0809ca6a48de4b4c63305eb84ef56, 407dc802a9c0809ca6a48de4b4c63305eb84ef56, 407dc802a9c0809ca6a48de4b4c63305eb84ef56, 407dc802a9c0809ca6a48de4b4c63305eb84ef56unaffected
LinuxLinux5.10, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.