PT-2026-61404 · Linux · Linux

CVE-2026-64087 · Published 2026-07-19 · Updated 2026-07-19

Mitre

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) reject implausible blackbox record count

adm1266 nvmem read blackbox() loops over a record count that comes straight from byte 3 of the BLACKBOX INFO response. The destination buffer is data->dev mem, sized for the nvmem cell's declared 2048 bytes (ADM1266 BLACKBOX MAX RECORDS * ADM1266 BLACKBOX SIZE = 32 * 64). A device that reports a record count greater than 32 -- whether due to firmware bugs, bus corruption, or a non-responsive slave returning 0xff -- would walk read buff past the end of the dev mem allocation on the trailing iterations.

Cap record count at ADM1266 BLACKBOX MAX RECORDS (introduced here) before entering the loop and return -EIO on any larger value, so a malformed BLACKBOX INFO response cannot drive the loop out of bounds.

Related Identifiers

CVE-2026-64087

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-64087 · Security Note
• https://git.kernel.org/stable/c/adcb163ad7cacca317872fc62bd8885e842e45e3 · Note
• https://git.kernel.org/stable/c/0e791cd0140fb136083565aadfbe0f705aa260d0 · Note
• https://git.kernel.org/stable/c/f85c81e93dbd6915970bd5f3bffcf62633c4c54c · Note
• https://git.kernel.org/stable/c/4afca954622d672ea65ed961bed01cf91caa034e · Note
• https://git.kernel.org/stable/c/c2c56092710fe8a893b67b5a3d7e62808d02d84d · Note
• https://git.kernel.org/stable/c/231db52a5b64d0a9769e298dadc148e1f79b26a6 · Note
• https://git.kernel.org/stable/c/5469e1e7c411acc15fdd8262c99c3ebd9defd594 · Note
• https://git.kernel.org/stable/c/75c862adf3d3caab4f49bb3530723c215376e37c · Note