CVE-2026-64085 - Vulnerability Details

- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer

Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer

adm1266_pmbus_block_xfer() copies the device-supplied block payload
into the caller-provided buffer using the device-supplied length:

memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]);

The helper does not know how large data_r is and trusts the device to
return at most one record's worth of bytes. adm1266_nvmem_read_blackbox()
violates that contract: it advances read_buff inside data->dev_mem in
ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to
write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns
more than 64 bytes on the trailing record (read_buff offset 1984 in
the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes
before the post-call

if (ret != ADM1266_BLACKBOX_SIZE)
return -EIO;

can reject the response.

Contain the fix in the caller without changing the helper signature:
read each record into a 255-byte local bounce buffer that matches the
helper's maximum output, validate the returned length, and only then
copy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot.

Published: 2026-07-19

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the adm1266 PMBus driver contains a buffer copy operation that blindly copies bytes from the device into a caller‑provided buffer without validating the buffer size. When an ADM1266 device returns a trailing record that is longer than the expected 64‑byte block, the copy can overwrite up to 191 bytes beyond the allocated memory area, corrupting kernel memory and potentially causing a crash or other instability.

Affected Systems

All Linux kernel releases that include the adm1266_pmbus driver before the patch that was committed on 43cae21424ff8e33894a0f86c6b80b840c049fd7. The kernel code is part of the hwmon subsystem and is used when an ADM1266 PMBus device is present on the system.

Risk and Exploitability

The EPSS score is reported as less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of exploitation. The CVE description does not specify an attack vector beyond the interaction with an ADM1266 device; it merely describes the code path that can lead to memory corruption. No information is provided about remote exploitation or required conditions beyond the presence of the device and the driver.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 7896d87cbb05e097efc113243d4e38f9f8cea16c
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 9d5309500b4607b7198e19f0a3fa13eb864cd5fb
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 6098634cfa711f11a8d65368dc51ec8f7c8241ba
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 60c4b9fe1a3dd012014b1f561a6928a0b5db1126
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 83e039f0a43e0708515b0479cb7690fb93faaaa0
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< dd47b8c4a0a8ced442da3f008db28fbbd31feaf0
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 43cae21424ff8e33894a0f86c6b80b840c049fd7

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,7896d87cbb05e097efc113243d4e38f9f8cea16c)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,9d5309500b4607b7198e19f0a3fa13eb864cd5fb)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,6098634cfa711f11a8d65368dc51ec8f7c8241ba)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,60c4b9fe1a3dd012014b1f561a6928a0b5db1126)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,83e039f0a43e0708515b0479cb7690fb93faaaa0)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,dd47b8c4a0a8ced442da3f008db28fbbd31feaf0)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,43cae21424ff8e33894a0f86c6b80b840c049fd7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.10`	affected	generic	—
`[0,5.10)`	unaffected	generic	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a kernel that includes the fix from commit 43cae21424ff8e33894a0f86c6b80b840c049fd7 or later.
If an immediate upgrade is not feasible, disable or block the ADM1266 PMBus device at the hardware or driver level to prevent the unsafe data transfer.
Monitor kernel logs for panic or SIGKILL messages related to hwmon or pmbus activity that could indicate an attempt to trigger the vulnerability.

Generated by OpenCVE AI on July 30, 2026 at 20:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/43cae21424ff8e33894a0f86c6b80b840c049fd7
https://git.kernel.org/stable/c/6098634cfa711f11a8d65368dc51ec8f7c8241ba
https://git.kernel.org/stable/c/60c4b9fe1a3dd012014b1f561a6928a0b5db1126
https://git.kernel.org/stable/c/7896d87cbb05e097efc113243d4e38f9f8cea16c
https://git.kernel.org/stable/c/83e039f0a43e0708515b0479cb7690fb93faaaa0
https://git.kernel.org/stable/c/97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f
https://git.kernel.org/stable/c/9d5309500b4607b7198e19f0a3fa13eb864cd5fb
https://git.kernel.org/stable/c/dd47b8c4a0a8ced442da3f008db28fbbd31feaf0
https://lore.kernel.org/linux-cve-announce/2026071916-CVE-2026-64085-d28f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64085
https://www.cve.org/CVERecord?id=CVE-2026-64085

History

Mon, 20 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120
References		https://lore.kernel.org/linux-cve-announce/2026071916-CVE-2026-64085-d28f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64085 https://www.cve.org/CVERecord?id=CVE-2026-64085

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer adm1266_pmbus_block_xfer() copies the device-supplied block payload into the caller-provided buffer using the device-supplied length: memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]); The helper does not know how large data_r is and trusts the device to return at most one record's worth of bytes. adm1266_nvmem_read_blackbox() violates that contract: it advances read_buff inside data->dev_mem in ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns more than 64 bytes on the trailing record (read_buff offset 1984 in the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes before the post-call if (ret != ADM1266_BLACKBOX_SIZE) return -EIO; can reject the response. Contain the fix in the caller without changing the helper signature: read each record into a 255-byte local bounce buffer that matches the helper's maximum output, validate the returned length, and only then copy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot.
Title		hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/43cae21424ff8e33894a0f86c6b80b840c049fd7 https://git.kernel.org/stable/c/6098634cfa711f11a8d65368dc51ec8f7c8241ba https://git.kernel.org/stable/c/60c4b9fe1a3dd012014b1f561a6928a0b5db1126 https://git.kernel.org/stable/c/7896d87cbb05e097efc113243d4e38f9f8cea16c https://git.kernel.org/stable/c/83e039f0a43e0708515b0479cb7690fb93faaaa0 https://git.kernel.org/stable/c/97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f https://git.kernel.org/stable/c/9d5309500b4607b7198e19f0a3fa13eb864cd5fb https://git.kernel.org/stable/c/dd47b8c4a0a8ced442da3f008db28fbbd31feaf0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:39:56.067Z

Updated: 2026-07-19T15:39:56.067Z

Reserved: 2026-07-19T07:54:57.032Z

Link: CVE-2026-64085

Vulnrichment

No data.

NVD

No data.

Redhat

Severity :

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64085 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T20:45:17Z

Weaknesses

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object