CVE-2026-64087: hwmon: (pmbus/adm1266) reject implausible blackbox record_count
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) reject implausible blackbox recordcount
adm1266nvmemreadblackbox() loops over a recordcount that comes straight from byte 3 of the BLACKBOXINFO response. The destination buffer is data->devmem, sized for the nvmem cell's declared 2048 bytes (ADM1266BLACKBOXMAXRECORDS ADM1266BLACKBOXSIZE = 32 64). A device that reports a recordcount greater than 32 -- whether due to firmware bugs, bus corruption, or a non-responsive slave returning 0xff -- would walk readbuff past the end of the devmem allocation on the trailing iterations.
Cap recordcount at ADM1266BLACKBOXMAXRECORDS (introduced here) before entering the loop and return -EIO on any larger value, so a malformed BLACKBOXINFO response cannot drive the loop out of bounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the fix in hwmon (pmbus/adm1266) so adm1266_nvmem_read_blackbox() rejects/caps any BLACKBOX_INFO record_count greater than ADM1266_BLACKBOX_MAX_RECORDS (so malformed responses cannot drive the loop out of bounds).
Linux kernel (hwmon: pmbus/adm1266) blackbox record_count handling = cap at ADM1266_BLACKBOX_MAX_RECORDS; return error for larger values
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel ADM1266 PMBus hardware-monitoring driver are exposed when the driver reads the device's blackbox NVMEM data. The issue is relevant only where an ADM1266 device or a device responding on its bus is involved.
What is required to trigger the out-of-bounds access?
A malformed BLACKBOX_INFO response must report a blackbox record count greater than 32. This can result from device firmware faults, bus corruption, or a non-responsive slave returning 0xff; the CVSS vector indicates local access and low privileges are required.
What happens when an invalid record count is received after the fix?
The driver caps valid blackbox records at 32 and returns -EIO when the reported count is larger. This prevents the read loop from advancing beyond the 2048-byte dev_mem buffer.