PT-2026-61402 · Linux · Linux
CVE-2026-64085
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
adm1266 pmbus block xfer() copies the device-supplied block payload
into the caller-provided buffer using the device-supplied length:
memcpy(data r, &msgs[1].buf[1], msgs[1].buf[0]);The helper does not know how large data r is and trusts the device to
return at most one record's worth of bytes. adm1266 nvmem read blackbox()
violates that contract: it advances read buff inside data->dev mem in
ADM1266 BLACKBOX SIZE (64-byte) strides while the helper is willing to
write up to ADM1266 PMBUS BLOCK MAX (255) bytes. A device that returns
more than 64 bytes on the trailing record (read buff offset 1984 in
the 2048-byte dev mem allocation) overflows dev mem by up to 191 bytes
before the post-call
if (ret != ADM1266 BLACKBOX SIZE)
return -EIO;can reject the response.
Contain the fix in the caller without changing the helper signature:
read each record into a 255-byte local bounce buffer that matches the
helper's maximum output, validate the returned length, and only then
copy exactly ADM1266 BLACKBOX SIZE bytes into the dev mem slot.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux