PT-2026-61403 · Linux · Linux

CVE-2026-64086

·

Publicado

2026-07-19

·

Atualizado

2026-07-19

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) include PEC byte in pmbus block xfer read buffer
adm1266 pmbus block xfer() sets up the read transaction with
.buf = data->read buf,
.len = ADM1266 PMBUS BLOCK MAX + 2,
but read buf in struct adm1266 data is declared as
u8 read buf[ADM1266 PMBUS BLOCK MAX + 1];
For a max-length block response (length byte = 255 + up to 1 PEC byte), the i2c controller is told to write 257 bytes into a 256-byte buffer, putting one byte past the end of read buf. The same response also makes the subsequent PEC compare
if (crc != msgs[1].buf[msgs[1].buf[0] + 1])
read a byte beyond the array.
Bump the read buf declaration to ADM1266 PMBUS BLOCK MAX + 2 so the buffer can hold the length byte, up to 255 payload bytes, and the PEC byte the i2c msg length already accounts for.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64086

Produtos afetados

Linux