CVE-2026-64083: hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
adm1266gpioget() and adm1266gpiogetmultiple() both compose the pin-status word as
pinsstatus = readbuf[0] + (readbuf[1] << 8);
right after i2csmbusreadblockdata(), guarding only against an error return. A well-behaved device returns 2 bytes for GPIOSTATUS/PDIOSTATUS, but the helper happily reports a 0- or 1-byte response too. If the device returns 0 bytes, both readbuf slots are uninitialized stack memory; if it returns 1 byte, readbuf[1] is.
The composed value then flows through setbit() into the caller's bits in adm1266gpiogetmultiple(), or into the return value of adm1266gpioget(), and ends up in userspace via gpiolib (sysfs and the char-dev ioctls). That leaks a few bits of kernel stack per request on any device whose firmware glitch, bus error, or hostile slave produces a short block-read response.
Add the missing length check to both call sites and surface a short response as -EIO.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add the missing length check to both call sites in adm1266_gpio_get() and adm1266_gpio_get_multiple() so that short i2c_smbus_read_block_data() block-read responses (0 bytes or 1 byte) are rejected and surfaced as -EIO instead of composing pins_status from uninitialized stack memory.
Linux kernel (hwmon: pmbus/adm1266) GPIO accessors Short block-read response handling in adm1266 GPIO helpers (adm1266_gpio_get() / adm1266_gpio_get_multiple()) = Reject responses with 0 or 1 byte and return -EIO
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel ADM1266 PMBus hardware-monitor driver are exposed when GPIO status is read from an ADM1266 device. Exposure requires that the device or I2C/SMBus path produces a zero- or one-byte block-read response instead of the expected two-byte response.
What does an attacker need to exploit it?
The CVSS vector indicates local access and low privileges, with no user interaction required. Exploitation also depends on causing or controlling a short GPIO_STATUS or PDIO_STATUS block-read response, such as through a hostile slave, firmware glitch, or bus error.
What is leaked and where can it be observed?
A short response can cause uninitialized kernel stack data to be incorporated into GPIO pin-status values. A few bits of that data may reach userspace through gpiolib, including sysfs and character-device ioctls.
How can affected behavior be recognized?
The relevant condition is an ADM1266 GPIO status read that succeeds at the transport level but returns fewer than two bytes. The corrected behavior treats such a short response as an I/O error (-EIO) rather than returning GPIO status derived from incomplete data.