CVE-2026-64084: hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) cap PDIO scan in getmultiple at ADM1266PDIONR
adm1266gpiogetmultiple() iterates the PDIO portion of the caller-supplied mask using
foreachsetbitfrom(gpionr, mask, ADM1266GPIONR + ADM1266PDIOSTATUS) { ... }
where ADM1266PDIOSTATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266GPIONR + ADM1266PDIONR = 25.
gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip), so the iteration walks findnextbit() up to 242, reading up to 217 extra bits (a handful of unsigned-long words: four on 64-bit, seven on 32-bit) of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a setbit(gpionr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds.
Substitute ADM1266PDIONR for the constant so the scan stops at the last real PDIO bit.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel ADM1266 PMBus hardware-monitoring driver are exposed when the driver's GPIO get_multiple operation is invoked. The affected path is specific to the ADM1266 device's 25 GPIO/PDIO lines.
What does an attacker need to exploit the flaw?
The CVSS vector identifies local access, low attack complexity, and low privileges as required; no user interaction is required. Exploitation depends on reaching the ADM1266 driver's GPIO bulk-read path and on incidental set bits in memory beyond the supplied mask.
What is the impact of the out-of-bounds access?
The driver can read beyond the caller-supplied GPIO mask and, if an out-of-range bit appears set, write beyond the caller-supplied output bit array. The reported CVSS metrics rate confidentiality, integrity, and availability impact as high.
What change fixes the issue?
The fix limits the PDIO scan using ADM1266_PDIO_NR rather than the PMBus command constant ADM1266_PDIO_STATUS. This stops iteration at the last valid PDIO bit instead of scanning up to 242 bits for a device with 25 GPIO lines.