The vulnerability resides in the adm1266 driver in the Linux kernel’s hwmon subsystem. An incorrect boundary constant causes the driver to iterate beyond the intended range of PDIO pins, resulting in an out‑of-bounds read of the caller’s mask and an out‑of-bounds write to the caller’s bits array (CWE‑125). The overwritten memory resides in kernel space, so the bug can corrupt kernel data structures, potentially leading to privilege escalation or a denial‑of‑service reboot.

All Linux kernel releases that include the adm1266 PMBus driver prior to the patch are affected. The bug targets any platform that ships the ADM1266 power monitor chip and loads the driver; that covers a range of embedded and consumer Linux systems. No specific kernel versions are enumerated beyond the fact that the patch is distributed as a new kernel commit series (see the provided commit references).

The CVSS base score of 7.8 indicates a high severity flaw. The EPSS score of <1% reflects a low but non‑zero likelihood of exploitation at this time, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can invoke the adm1266 API from user space—i.e., through a privileged or regular application that accesses the device node—can supply the offending mask and trigger the out‑of‑bounds write. The exploit would require local access to the hardware device and could result in kernel corruption and subsequent privilege escalation or system crash.