PT-2026-61402 · Linux · Linux
CVE-2026-64085
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
adm1266 pmbus block xfer() copies the device-supplied block payload
into the caller-provided buffer using the device-supplied length:
memcpy(data r, &msgs[1].buf[1], msgs[1].buf[0]);The helper does not know how large data r is and trusts the device to
return at most one record's worth of bytes. adm1266 nvmem read blackbox()
violates that contract: it advances read buff inside data->dev mem in
ADM1266 BLACKBOX SIZE (64-byte) strides while the helper is willing to
write up to ADM1266 PMBUS BLOCK MAX (255) bytes. A device that returns
more than 64 bytes on the trailing record (read buff offset 1984 in
the 2048-byte dev mem allocation) overflows dev mem by up to 191 bytes
before the post-call
if (ret != ADM1266 BLACKBOX SIZE)
return -EIO;can reject the response.
Contain the fix in the caller without changing the helper signature:
read each record into a 255-byte local bounce buffer that matches the
helper's maximum output, validate the returned length, and only then
copy exactly ADM1266 BLACKBOX SIZE bytes into the dev mem slot.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux