CVE-2026-64084: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64084 Overview

CVE-2026-64084 is an out-of-bounds read and write vulnerability in the Linux kernel's hwmon subsystem, specifically in the pmbus/adm1266 driver. The flaw resides in adm1266_gpio_get_multiple(), which iterates the PDIO portion of a caller-supplied bitmask using an incorrect upper bound. The code uses ADM1266_PDIO_STATUS (0xE9, the PMBus command code value 233) instead of ADM1266_PDIO_NR (the actual number of PDIO pins). This causes the scan to walk find_next_bit() up to offset 242, reading up to 217 extra bits past the end of the mask and potentially writing past the end of the caller-supplied bits array.

Critical Impact
Local attackers with access to the ADM1266 GPIO interface can trigger out-of-bounds reads and writes on the kernel stack, potentially leading to memory corruption, information disclosure, or privilege escalation.

Affected Products

Linux kernel versions containing the pmbus/adm1266 hwmon driver prior to the fix
Systems using the Analog Devices ADM1266 cascadable super sequencer with monitoring via PMBus
Distributions shipping the affected kernel builds pending backport of the referenced stable patches

Discovery Timeline

2026-07-19 - CVE-2026-64084 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64084

Vulnerability Analysis

The vulnerability is a classic bounds confusion between two similarly named constants. Inside adm1266_gpio_get_multiple(), the driver uses for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) to iterate over the PDIO portion of the caller's bitmask. ADM1266_PDIO_STATUS is a PMBus command byte with value 0xE9 (233), not a pin count. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR, which equals 25 on this chip.

Because gpiolib supplies a mask sized for gc.ngpio (25 bits), the loop reads well beyond the allocated mask storage. On 64-bit systems it touches four extra unsigned long words past the end; on 32-bit systems it reads seven extra words. Any incidental set bit encountered in that out-of-bounds range triggers a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array. The combined out-of-bounds read and write occurs on the caller's stack.

Root Cause

The root cause is an incorrect symbol reference introduced in the loop bound expression. The developer used ADM1266_PDIO_STATUS (a PMBus register command code) where ADM1266_PDIO_NR (a pin count constant) was intended. This is a classic Out-of-Bounds Read [CWE-125] and Out-of-Bounds Write [CWE-787] arising from an improper bounds check.

Attack Vector

Exploitation requires local access with sufficient privilege to invoke GPIO operations on the ADM1266 device through gpiolib interfaces such as /dev/gpiochipN or sysfs. Any call path that reaches adm1266_gpio_get_multiple() with a mask having set bits inside the erroneous 233-bit iteration range will trigger the out-of-bounds behavior. Because the affected buffer lives on the caller's stack, controlled adjacent state may lead to memory corruption of return addresses or nearby kernel objects. The vulnerability does not require network access or user interaction.

No verified public exploit code is available. See the referenced stable kernel patches for the corrective change: Kernel Patch 17cee2f590 and Kernel Patch fa7ca36306.

Detection Methods for CVE-2026-64084

Indicators of Compromise

Unexpected kernel oops, warning, or panic messages referencing adm1266_gpio_get_multiple or pmbus_core in dmesg or /var/log/kern.log.
KASAN reports flagging out-of-bounds read or write inside adm1266_gpio_get_multiple() on systems built with CONFIG_KASAN=y.
Anomalous GPIO character device (/dev/gpiochipN) access from unprivileged or unexpected processes on systems using ADM1266.

Detection Strategies

Enumerate loaded kernel modules and verify whether adm1266 is present using lsmod | grep adm1266 on systems that expose PMBus hardware.
Compare running kernel versions against the fixed commits referenced by the stable tree to identify unpatched hosts.
Enable KASAN in test environments to surface out-of-bounds access patterns during regression and fuzzing of the GPIO interface.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on stack-trace signatures referencing adm1266_gpio_get_multiple or for_each_set_bit_from.
Monitor process access to /dev/gpiochip* and PMBus i2c-dev nodes, and alert on access by processes outside authorized management daemons.
Track kernel package versions across the fleet and flag hosts running kernels predating the referenced stable patches.

How to Mitigate CVE-2026-64084

Immediate Actions Required

Apply the upstream kernel fix that substitutes ADM1266_PDIO_NR for ADM1266_PDIO_STATUS in adm1266_gpio_get_multiple(), or upgrade to a stable kernel release containing the referenced commits.
Restrict access to GPIO character devices and PMBus interfaces to trusted administrative accounts using file permissions and udev rules.
Audit which local accounts and services can reach the ADM1266 GPIO interface and remove unnecessary privileges.

Patch Information

The fix has been merged into the mainline and multiple stable branches. Relevant commits include Kernel Patch 17cee2f590, Kernel Patch 299efd14c2, Kernel Patch 2aef8f08c4, Kernel Patch 4d1da9a6be, Kernel Patch b96c7f0bc0, Kernel Patch d0593e15fd, Kernel Patch d7834d9225, and Kernel Patch fa7ca36306. The corrective change bounds the PDIO iteration at ADM1266_GPIO_NR + ADM1266_PDIO_NR (25) so the scan terminates at the last valid PDIO bit.

Workarounds

Blacklist the adm1266 module on systems that do not require ADM1266 monitoring by adding blacklist adm1266 to /etc/modprobe.d/ configuration.
Remove GPIO character device access for non-root users and enforce this policy through udev rules setting restrictive ownership and mode.
Disable or unbind the ADM1266 driver at runtime on affected hardware until the patched kernel is deployed.

bash

# Configuration example: prevent adm1266 module load until patched kernel is deployed
echo 'blacklist adm1266' | sudo tee /etc/modprobe.d/cve-2026-64084.conf
sudo depmod -a
# Restrict access to GPIO char devices to root only
echo 'KERNEL=="gpiochip*", OWNER="root", GROUP="root", MODE="0600"' | \
  sudo tee /etc/udev/rules.d/90-gpiochip-restrict.rules
sudo udevadm control --reload-rules