CVE-2026-64086: hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) include PEC byte in pmbusblockxfer read buffer
adm1266pmbusblockxfer() sets up the read transaction with
.buf = data->readbuf, .len = ADM1266PMBUSBLOCKMAX + 2,
but readbuf in struct adm1266data is declared as
u8 readbuf[ADM1266PMBUSBLOCKMAX + 1];
For a max-length block response (length byte = 255 + up to 1 PEC byte), the i2c controller is told to write 257 bytes into a 256-byte buffer, putting one byte past the end of readbuf. The same response also makes the subsequent PEC compare
if (crc != msgs[1].buf[msgs[1].buf[0] + 1])
read a byte beyond the array.
Bump the readbuf declaration to ADM1266PMBUSBLOCKMAX + 2 so the buffer can hold the length byte, up to 255 payload bytes, and the PEC byte the i2cmsg length already accounts for.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Increase struct adm1266_data::read_buf from u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1] to u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 2] so the read buffer can hold the length byte (up to 255 payload bytes) plus the PEC byte, preventing a one-byte overrun.
Linux kernel (hwmon/pmbus/adm1266) adm1266_data.read_buf array size = u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 2]
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the ADM1266 PMBus hardware-monitoring driver are exposed when that driver performs a maximum-length PMBus block read response. The issue is local in the supplied CVSS vector, so it is not described as remotely exploitable.
What does an attacker need to exploit it?
The CVSS vector indicates local access, low attack complexity, and low privileges, with no user interaction required. Exploitation also depends on reaching the affected ADM1266 PMBus block-transfer path and causing a maximum-length response that includes the PEC byte.
What is the impact of a successful exploit?
A maximum-length response can cause the I2C controller to write one byte beyond the read buffer, and the subsequent PEC validation can also read beyond that buffer. The supplied CVSS vector rates confidentiality, integrity, and availability impact as high.
How can I determine whether a system is affected?
Check whether the running kernel includes the ADM1266 PMBus driver and whether its adm1266 read buffer has space for the length byte, up to 255 payload bytes, and one PEC byte. The corrected buffer size is ADM1266_PMBUS_BLOCK_MAX + 2 rather than ADM1266_PMBUS_BLOCK_MAX + 1.
What can be done if an updated kernel cannot be deployed immediately?
The provided data does not identify a configuration workaround. Reducing untrusted local access and avoiding use of the affected ADM1266 PMBus block-read path until the kernel fix is applied may reduce exposure.