CVE-2026-64083: Linux Kernel Information Disclosure Flaw

CVE-2026-64083 Overview

CVE-2026-64083 is a Linux kernel information disclosure vulnerability in the hwmon pmbus driver for the Analog Devices ADM1266 power sequencer. The flaw resides in the GPIO accessor functions adm1266_gpio_get() and adm1266_gpio_get_multiple(), which fail to validate the length of block-read responses from the I2C device. A short response from the device leaves stack buffer bytes uninitialized, and those bytes are propagated to userspace through gpiolib sysfs entries and character-device ioctls.

Critical Impact
A malicious, malfunctioning, or bus-glitched ADM1266 device can cause the kernel to leak small amounts of kernel stack memory to userspace on every GPIO status read.

Affected Products

Linux kernel hwmon subsystem — pmbus/adm1266 driver
Systems using Analog Devices ADM1266 cascadable power sequencers over I2C
Multiple stable kernel branches (fixes backported across eight stable trees)

Discovery Timeline

2026-07-19 - CVE-2026-64083 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64083

Vulnerability Analysis

The ADM1266 driver reads GPIO and PDIO pin status over SMBus block reads. Both adm1266_gpio_get() and adm1266_gpio_get_multiple() compose the 16-bit pin-status word directly from the receive buffer with the expression pins_status = read_buf[0] + (read_buf[1] << 8);. The code only checks for a negative error return from i2c_smbus_read_block_data() and does not verify that the device returned the expected two bytes.

A well-behaved ADM1266 returns exactly two bytes for GPIO_STATUS and PDIO_STATUS transactions. When the device returns zero bytes, both read_buf[0] and read_buf[1] remain uninitialized stack memory. When one byte is returned, read_buf[1] remains uninitialized. The tainted value then flows through set_bit() into the caller's *bits output or into the return value of the getter.

Root Cause

The root cause is a missing length validation after an SMBus block-read operation, leading to Uninitialized Memory Use [CWE-908] and Information Exposure [CWE-200]. The driver assumes the device always adheres to the protocol contract and returns two payload bytes, but SMBus block reads carry a variable length that the caller must inspect.

Attack Vector

Exploitation requires a device on the I2C bus that returns a short block-read response. This can occur through firmware bugs on the ADM1266, transient bus errors, or a hostile or physically substituted I2C slave. Once triggered, each GPIO status read exposed via gpiolib sysfs (/sys/class/gpio/) or the /dev/gpiochipN ioctl interface leaks a few bits of kernel stack per request to any local user with access to those interfaces.

Because the vulnerability requires local access to gpiolib interfaces and a cooperating or misbehaving device, it does not enable remote exploitation. The disclosed bytes can, however, aid other exploitation chains by revealing kernel stack contents such as pointers or canary values. See the kernel commit fixing the driver for the applied length check.

Detection Methods for CVE-2026-64083

Indicators of Compromise

Repeated reads from /sys/class/gpio/gpiochipN/ or /dev/gpiochipN entries backed by an ADM1266 device, especially from non-administrative processes.
Kernel logs showing -EIO returns from the ADM1266 driver after the fix is applied, indicating short block-read responses in the field.
I2C bus traces showing GPIO_STATUS or PDIO_STATUS responses with a length field less than 2.

Detection Strategies

Audit installed kernel package versions against the fixed stable releases referenced in the upstream commits (64fa932, a2d1c81, a7232f6, ae25cf2, c603b6c, eb3cd9b, ee4799b, fd9196a).
Enumerate systems that load the adm1266 module using package inventory and runtime module listings (lsmod | grep adm1266).
Monitor unusual access patterns to gpiochip character devices via kernel audit rules on openat calls to /dev/gpiochip*.

Monitoring Recommendations

Enable Linux audit logging for gpiolib character-device access and correlate with process identity.
Track kernel error counters and dmesg entries associated with the pmbus/adm1266 driver for -EIO failures introduced by the patch.
Include the fixed kernel versions in vulnerability management scans across Linux fleets that use ADM1266-based power sequencing hardware.

How to Mitigate CVE-2026-64083

Immediate Actions Required

Apply the stable kernel updates that include the length check in adm1266_gpio_get() and adm1266_gpio_get_multiple().
Restrict access to gpiolib sysfs entries and /dev/gpiochip* device nodes to trusted administrative users only.
Inventory hardware to identify systems using ADM1266 power sequencers on I2C and prioritize those hosts for patching.

Patch Information

The fix adds a length check after i2c_smbus_read_block_data() in both accessor functions and returns -EIO when the response is shorter than two bytes. The patch has been applied across multiple stable trees. Refer to the upstream commits: 64fa9328948d, a2d1c819348b, a7232f68c43c, ae25cf2ea9eb, c603b6c6840a, eb3cd9bb5904, ee4799becf7d, and fd9196aad9e5.

Workarounds

If patching is not immediately possible, unload the adm1266 module on hosts where the driver is not operationally required.
Tighten Unix permissions on /sys/class/gpio/ and /dev/gpiochip* so only root or a dedicated hardware-management group can read GPIO status.
On multi-tenant systems, deny unprivileged processes access to gpiolib interfaces through mandatory access control policies (SELinux, AppArmor).

bash

# Configuration example: remove the adm1266 module and restrict gpiochip access
sudo modprobe -r adm1266
echo "blacklist adm1266" | sudo tee /etc/modprobe.d/blacklist-adm1266.conf
sudo chmod 600 /dev/gpiochip*
sudo chown root:root /dev/gpiochip*