PT-2026-61452 · Linux · Linux
CVE-2026-64135
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C SMBUS BLOCK MAX
adm1266 nvmem read blackbox() declares a 5-byte stack buffer and
passes it to i2c smbus read block data() to retrieve the 4-byte
BLACKBOX INFO response. i2c smbus read block data() does not honour
caller buffer sizes -- it memcpy()s data.block[0] bytes from the
SMBus transaction (where data.block[0] is the length byte returned by
the slave device, up to I2C SMBUS BLOCK MAX = 32):
memcpy(values, &data.block[1], data.block[0]);If the device returns any block length above 5, the call overflows
the caller's 5-byte stack buffer before the post-call
if (ret != 4)
return -EIO;check has a chance to reject the response.
Widen the local buffer to I2C SMBUS BLOCK MAX so the helper has room
for any well-formed SMBus block response, matching the convention used
by the other i2c smbus read block data() callers in this driver.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux