CVE-2026-64086 - Vulnerability Details

- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer

Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer

adm1266_pmbus_block_xfer() sets up the read transaction with

.buf = data->read_buf,
.len = ADM1266_PMBUS_BLOCK_MAX + 2,

but read_buf in struct adm1266_data is declared as

u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1];

For a max-length block response (length byte = 255 + up to 1 PEC
byte), the i2c controller is told to write 257 bytes into a 256-byte
buffer, putting one byte past the end of read_buf. The same response
also makes the subsequent PEC compare

if (crc != msgs[1].buf[msgs[1].buf[0] + 1])

read a byte beyond the array.

Bump the read_buf declaration to ADM1266_PMBUS_BLOCK_MAX + 2 so the
buffer can hold the length byte, up to 255 payload bytes, and the PEC
byte the i2c_msg length already accounts for.

Published: 2026-07-19

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the adm1266 pmbus driver prepares a 257‑byte read transaction while allocating only a 256‑byte buffer. This out‑of‑bounds write can corrupt kernel memory, potentially destabilizing the system or giving a local attacker that controls the I2C bus the ability to elevate privileges. The weakness is a classic out‑of‑bounds write (CWE‑787).

Affected Systems

All Linux kernel releases that include the adm1266 pmbus driver are affected, including the generic production kernel and the 7.1 RC releases identified by the CPE list. Any kernel build that compiles the adm1266 driver (enabled by CONFIG_PMBUS_ADM1266) will be vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local access to the I2C bus or control over the device using the adm1266 driver; remote exploitation would require compromising the I2C bus or kernel code, which is presently unlikely.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 397d3f523bfff2f4e3dacf9b1339bd76dc207f78
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 472744f69d25a2d5111ad62f1d62579dce2c13c8
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 528a9f88e88502d0c2f2052a279415074cd83715
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< d94ceb16e55b6d8019ab069e357c76ac42f0ffbc
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< bd5be3fa5de6dbf61f1b3cec6b79c2c2f8065694
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 2279c342d94eca225bf9f301c8806a05a1c81619
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< a6c802145a8de0830bca803c6d415f7e9e683624
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 487566cb1ccdf3756fdd7bf8d875e612ff3169bb

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,397d3f523bfff2f4e3dacf9b1339bd76dc207f78)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,472744f69d25a2d5111ad62f1d62579dce2c13c8)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,528a9f88e88502d0c2f2052a279415074cd83715)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,d94ceb16e55b6d8019ab069e357c76ac42f0ffbc)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,bd5be3fa5de6dbf61f1b3cec6b79c2c2f8065694)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,2279c342d94eca225bf9f301c8806a05a1c81619)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,a6c802145a8de0830bca803c6d415f7e9e683624)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,487566cb1ccdf3756fdd7bf8d875e612ff3169bb)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.10`	affected	semver	—
`[0,5.10)`	unaffected	semver	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that contains the patch for the adm1266 pmbus driver, which expands the read buffer to the correct size.
If an upgrade cannot be performed immediately, unload or disable the adm1266 module or remove the corresponding I2C device to stop the vulnerable transaction, thereby preventing the out‑of‑bounds write.
In environments where the device cannot be removed, isolate the I2C bus or block unauthorized traffic from the affected device to prevent the vulnerable transaction from occurring.

Generated by OpenCVE AI on September 3, 2026 at 22:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8729-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8761-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8729-2	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8761-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00139.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2279c342d94eca225bf9f301c8806a05a1c81619
https://git.kernel.org/stable/c/397d3f523bfff2f4e3dacf9b1339bd76dc207f78
https://git.kernel.org/stable/c/472744f69d25a2d5111ad62f1d62579dce2c13c8
https://git.kernel.org/stable/c/487566cb1ccdf3756fdd7bf8d875e612ff3169bb
https://git.kernel.org/stable/c/528a9f88e88502d0c2f2052a279415074cd83715
https://git.kernel.org/stable/c/a6c802145a8de0830bca803c6d415f7e9e683624
https://git.kernel.org/stable/c/bd5be3fa5de6dbf61f1b3cec6b79c2c2f8065694
https://git.kernel.org/stable/c/d94ceb16e55b6d8019ab069e357c76ac42f0ffbc
https://lore.kernel.org/linux-cve-announce/2026071916-CVE-2026-64086-fb53@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64086
https://www.cve.org/CVERecord?id=CVE-2026-64086

History

Thu, 03 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://lore.kernel.org/linux-cve-announce/2026071916-CVE-2026-64086-fb53@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64086 https://www.cve.org/CVERecord?id=CVE-2026-64086

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer adm1266_pmbus_block_xfer() sets up the read transaction with .buf = data->read_buf, .len = ADM1266_PMBUS_BLOCK_MAX + 2, but read_buf in struct adm1266_data is declared as u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1]; For a max-length block response (length byte = 255 + up to 1 PEC byte), the i2c controller is told to write 257 bytes into a 256-byte buffer, putting one byte past the end of read_buf. The same response also makes the subsequent PEC compare if (crc != msgs[1].buf[msgs[1].buf[0] + 1]) read a byte beyond the array. Bump the read_buf declaration to ADM1266_PMBUS_BLOCK_MAX + 2 so the buffer can hold the length byte, up to 255 payload bytes, and the PEC byte the i2c_msg length already accounts for.
Title		hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2279c342d94eca225bf9f301c8806a05a1c81619 https://git.kernel.org/stable/c/397d3f523bfff2f4e3dacf9b1339bd76dc207f78 https://git.kernel.org/stable/c/472744f69d25a2d5111ad62f1d62579dce2c13c8 https://git.kernel.org/stable/c/487566cb1ccdf3756fdd7bf8d875e612ff3169bb https://git.kernel.org/stable/c/528a9f88e88502d0c2f2052a279415074cd83715 https://git.kernel.org/stable/c/a6c802145a8de0830bca803c6d415f7e9e683624 https://git.kernel.org/stable/c/bd5be3fa5de6dbf61f1b3cec6b79c2c2f8065694 https://git.kernel.org/stable/c/d94ceb16e55b6d8019ab069e357c76ac42f0ffbc

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:39:56.749Z

Updated: 2026-08-05T12:39:03.986Z

Reserved: 2026-07-19T07:54:57.032Z

Link: CVE-2026-64086

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-19T16:17:49.300

Modified: 2026-09-03T16:12:53.580

Link: CVE-2026-64086

Redhat

Severity :

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64086 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-03T23:00:11Z

Weaknesses

CWE-787
Out-of-bounds Write
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object