CVE-2026-64086 - Vulnerability Details

- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer

Description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer

adm1266_pmbus_block_xfer() sets up the read transaction with

.buf = data->read_buf,
.len = ADM1266_PMBUS_BLOCK_MAX + 2,

but read_buf in struct adm1266_data is declared as

u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1];

For a max-length block response (length byte = 255 + up to 1 PEC
byte), the i2c controller is told to write 257 bytes into a 256-byte
buffer, putting one byte past the end of read_buf. The same response
also makes the subsequent PEC compare

if (crc != msgs[1].buf[msgs[1].buf[0] + 1])

read a byte beyond the array.

Bump the read_buf declaration to ADM1266_PMBUS_BLOCK_MAX + 2 so the
buffer can hold the length byte, up to 255 payload bytes, and the PEC
byte the i2c_msg length already accounts for.

Published: 2026-07-19

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A local buffer overrun exists in the pmbus driver for the ADM1266 hardware monitoring device. The code allocates a 256‑byte read buffer but tells the I2C controller to write up to 257 bytes, causing a write beyond the array bounds. This corruption can lead to kernel memory corruption, system stability issues, or potential exploitation for privilege escalation. The weakness is a classic case of out‑of‑bounds write (CWE‑787).

Affected Systems

All Linux kernel releases that include the adm1266 pmbus driver are affected. The advisory covers the generic Linux kernel image. No specific version range was supplied, so any kernel built with the adm1266 driver is potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.8 marks the issue as high severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector is local access to the I2C bus or control over a device using the adm1266 driver, rather than through remote means. If an attacker achieves this, the resulting buffer overrun could crash the kernel or lead to privilege escalation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 397d3f523bfff2f4e3dacf9b1339bd76dc207f78
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 472744f69d25a2d5111ad62f1d62579dce2c13c8
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 528a9f88e88502d0c2f2052a279415074cd83715
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< d94ceb16e55b6d8019ab069e357c76ac42f0ffbc
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< bd5be3fa5de6dbf61f1b3cec6b79c2c2f8065694
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 2279c342d94eca225bf9f301c8806a05a1c81619
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< a6c802145a8de0830bca803c6d415f7e9e683624
`407dc802a9c0809ca6a48de4b4c63305eb84ef56`	affected	< 487566cb1ccdf3756fdd7bf8d875e612ff3169bb

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,397d3f523bfff2f4e3dacf9b1339bd76dc207f78)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,472744f69d25a2d5111ad62f1d62579dce2c13c8)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,528a9f88e88502d0c2f2052a279415074cd83715)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,d94ceb16e55b6d8019ab069e357c76ac42f0ffbc)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,bd5be3fa5de6dbf61f1b3cec6b79c2c2f8065694)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,2279c342d94eca225bf9f301c8806a05a1c81619)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,a6c802145a8de0830bca803c6d415f7e9e683624)`	affected	code_commit	—
`[407dc802a9c0809ca6a48de4b4c63305eb84ef56,487566cb1ccdf3756fdd7bf8d875e612ff3169bb)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.10`	affected	semver	—
`[0,5.10)`	unaffected	semver	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that contains the patch for the adm1266 pmbus driver, which fixes the buffer overrun (CWE‑787) by expanding the read buffer to the correct size.
If an upgrade cannot be performed immediately, unload or disable the adm1266 driver or remove the corresponding I2C device to stop the vulnerable transaction, thereby preventing the out‑of‑bounds write.
In environments where the device cannot be removed, isolate the I2C bus or block unauthorized traffic from the affected device to prevent the vulnerable transaction from occurring, mitigating the potential buffer overflow.
Monitor kernel logs for signs of I2C read overflows and ensure that any custom firmware interacting with the device is updated to avoid sending oversized responses.

Generated by OpenCVE AI on July 30, 2026 at 20:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00139.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2279c342d94eca225bf9f301c8806a05a1c81619
https://git.kernel.org/stable/c/397d3f523bfff2f4e3dacf9b1339bd76dc207f78
https://git.kernel.org/stable/c/472744f69d25a2d5111ad62f1d62579dce2c13c8
https://git.kernel.org/stable/c/487566cb1ccdf3756fdd7bf8d875e612ff3169bb
https://git.kernel.org/stable/c/528a9f88e88502d0c2f2052a279415074cd83715
https://git.kernel.org/stable/c/a6c802145a8de0830bca803c6d415f7e9e683624
https://git.kernel.org/stable/c/bd5be3fa5de6dbf61f1b3cec6b79c2c2f8065694
https://git.kernel.org/stable/c/d94ceb16e55b6d8019ab069e357c76ac42f0ffbc
https://lore.kernel.org/linux-cve-announce/2026071916-CVE-2026-64086-fb53@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64086
https://www.cve.org/CVERecord?id=CVE-2026-64086

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://lore.kernel.org/linux-cve-announce/2026071916-CVE-2026-64086-fb53@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64086 https://www.cve.org/CVERecord?id=CVE-2026-64086

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer adm1266_pmbus_block_xfer() sets up the read transaction with .buf = data->read_buf, .len = ADM1266_PMBUS_BLOCK_MAX + 2, but read_buf in struct adm1266_data is declared as u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1]; For a max-length block response (length byte = 255 + up to 1 PEC byte), the i2c controller is told to write 257 bytes into a 256-byte buffer, putting one byte past the end of read_buf. The same response also makes the subsequent PEC compare if (crc != msgs[1].buf[msgs[1].buf[0] + 1]) read a byte beyond the array. Bump the read_buf declaration to ADM1266_PMBUS_BLOCK_MAX + 2 so the buffer can hold the length byte, up to 255 payload bytes, and the PEC byte the i2c_msg length already accounts for.
Title		hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2279c342d94eca225bf9f301c8806a05a1c81619 https://git.kernel.org/stable/c/397d3f523bfff2f4e3dacf9b1339bd76dc207f78 https://git.kernel.org/stable/c/472744f69d25a2d5111ad62f1d62579dce2c13c8 https://git.kernel.org/stable/c/487566cb1ccdf3756fdd7bf8d875e612ff3169bb https://git.kernel.org/stable/c/528a9f88e88502d0c2f2052a279415074cd83715 https://git.kernel.org/stable/c/a6c802145a8de0830bca803c6d415f7e9e683624 https://git.kernel.org/stable/c/bd5be3fa5de6dbf61f1b3cec6b79c2c2f8065694 https://git.kernel.org/stable/c/d94ceb16e55b6d8019ab069e357c76ac42f0ffbc

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:39:56.749Z

Updated: 2026-08-05T12:39:03.986Z

Reserved: 2026-07-19T07:54:57.032Z

Link: CVE-2026-64086

Vulnrichment

No data.

NVD

No data.

Redhat

Severity :

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64086 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T20:45:17Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object