CVE-2026-64135 Details
Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX adm1266_nvmem_read_blackbox() declares a 5-byte stack buffer and passes it to i2c_smbus_read_block_data() to retrieve the 4-byte BLACKBOX_INFO response. i2c_smbus_read_block_data() does not honour caller buffer sizes -- it memcpy()s data.block[0] bytes from the SMBus transaction (where data.block[0] is the length byte returned by the slave device, up to I2C_SMBUS_BLOCK_MAX = 32): memcpy(values, &data.block[1], data.block[0]); If the device returns any block length above 5, the call overflows the caller's 5-byte stack buffer before the post-call if (ret != 4) return -EIO; check has a chance to reject the response. Widen the local buffer to I2C_SMBUS_BLOCK_MAX so the helper has room for any well-formed SMBus block response, matching the convention used by the other i2c_smbus_read_block_data() callers in this driver.
A stack buffer overflow vulnerability has been identified in the Linux kernel's PMBus ADM1266 driver. The issue arises in the 'adm1266_nvmem_read_blackbox' function, which allocates a 5-byte buffer and uses it to read a 4-byte BLACKBOX_INFO response via the 'i2c_smbus_read_block_data' function. However, 'i2c_smbus_read_block_data' does not respect the size of the caller's buffer. Instead, it copies data based on a length byte returned by the slave device, which can be as much as 32 bytes. If the length byte indicates a size greater than 5, this leads to a buffer overflow, as the response exceeds the allocated stack buffer size. The vulnerability has been addressed by increasing the buffer size to accommodate the maximum expected SMBus block length, aligning with the handling in other parts of the driver.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0dbf64c502443c08c2e28a77ecbfcc5479d93228 | kernel.org | Patch |
| https://git.kernel.org/stable/c/2b7a698d5093b548c464828d984f05ced5f3fd2a | kernel.org | Patch |
| https://git.kernel.org/stable/c/33251abb9c9dd62943be76f0427c5527ee39188f | kernel.org | Patch |
| https://git.kernel.org/stable/c/6ed16a40b162e9d87d9ac8bed4d7f0e3e807700e | kernel.org | Patch |
| https://git.kernel.org/stable/c/7f705e581ef3e6bb308a121a89adf5237d968204 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ba09f4baa5bd96c5d26c942defa546a72dbbe5bf | kernel.org | Patch |
| https://git.kernel.org/stable/c/ca560f7566df7e2826c2999e959e6b94eb938f76 | kernel.org | Patch |
| https://git.kernel.org/stable/c/eee213daa1e1b402eb631bcd1b8c5aa340a6b081 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.10, < 5.10.258 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.142 >= 6.7, < 6.12.92 >= 6.13, < 6.18.34 >= 6.19, < 7.0.11 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 13, 2026 | Initial Analysis | [email protected] |
| Jul 19, 2026 | New CVE Received | kernel.org |