The adm1266_nvmem_read_blackbox routine processes a record_count field extracted from byte 3 of the BLACKBOX_INFO response. When a device reports a value larger than 32, the kernel erroneously loops beyond the end of its allocated dev_mem buffer, which is sized for 2048 bytes (32 records of 64 bytes each). This out‑of‑bounds read can expose unrelated kernel memory contents or trigger a crash. The defect can arise from firmware bugs, bus corruption, or a non‑responsive slave that returns 0xff, making the vulnerability realistically exploitable in systems that use the adm1266 sensor via the pmbus interface.

The flaw resides in the Linux kernel’s hardware monitoring subsystem and affects any kernel image that includes the adm1266 driver. Because the CPE is generic for the Linux kernel, no specific kernel releases are enumerated in the advisory. All Linux distributions shipping kernel versions that compile the adm1266 driver without the patch are potentially impacted.

The CVSS score is not listed, and the EPSS score is below 1 %, indicating a very low probability of widespread exploitation. The flaw is not in CISA’s KEV catalog. Exploitation requires an attacker who can influence the sensor’s SMBus traffic or has local access to a system that talks to an adm1266 slave. The missing record_count check allows the kernel to read past the allocated buffer, but the patched driver now caps the value to 32 and returns –EIO for larger counts, mitigating the immediate threat.