CVE-2026-64085: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
adm1266pmbusblockxfer() copies the device-supplied block payload into the caller-provided buffer using the device-supplied length:
memcpy(datar, &msgs[1].buf[1], msgs[1].buf[0]);
The helper does not know how large datar is and trusts the device to return at most one record's worth of bytes. adm1266nvmemreadblackbox() violates that contract: it advances readbuff inside data->devmem in ADM1266BLACKBOXSIZE (64-byte) strides while the helper is willing to write up to ADM1266PMBUSBLOCKMAX (255) bytes. A device that returns more than 64 bytes on the trailing record (readbuff offset 1984 in the 2048-byte devmem allocation) overflows devmem by up to 191 bytes before the post-call
if (ret != ADM1266BLACKBOXSIZE) return -EIO;
can reject the response.
Contain the fix in the caller without changing the helper signature: read each record into a 255-byte local bounce buffer that matches the helper's maximum output, validate the returned length, and only then copy exactly ADM1266BLACKBOXSIZE bytes into the devmem slot.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the adm1266 helper path, ensure the helper copies only fixed-size blackbox records by copying exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot, validate that ret == ADM1266_BLACKBOX_SIZE, and only then bounce the record through a protocol-sized buffer into the caller-provided buffer. If ret != ADM1266_BLACKBOX_SIZE, return -EIO.
hwmon: (pmbus/adm1266) dev_mem copying bounds = copy exactly ADM1266_BLACKBOX_SIZE bytes and validate returned length - Configuration
When reading trailing records, read each record into a 255-byte local bounce buffer (matching the 2048-byte dev_mem allocation contract). Do not advance read_buff inside data->dev_mem based on device-supplied length; return at most one record's worth of bytes (up to ADM1266_PMBUS_BLOCK_MAX/255), and reject any device response with unexpected length.
hwmon: (pmbus/adm1266) read_buff bounce buffer size = 255-byte local bounce buffer
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local attack access with low privileges and no user interaction. Exploitation depends on causing the affected ADM1266 blackbox read path to receive an oversized device-supplied record.
Which systems are exposed?
Systems running the Linux kernel with the ADM1266 PMBus hardware-monitor driver and using its blackbox NVMEM read functionality are relevant. The issue is tied to device responses during blackbox record reads, rather than a network-accessible interface.
What happens if an affected device returns an oversized trailing record?
The driver can write beyond its 2048-byte dev_mem allocation by up to 191 bytes before it checks and rejects a record whose length is not 64 bytes. This can affect confidentiality, integrity, and availability.
How is the issue fixed?
The corrected read path receives each record into a local 255-byte buffer, validates the returned length, and copies only the expected 64 bytes into the destination slot. The listed stable kernel references identify commits containing the resolution.