CVE-2026-64085: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64085 Overview

CVE-2026-64085 is a heap buffer overflow vulnerability in the Linux kernel's hwmon subsystem, specifically within the pmbus/adm1266 driver. The flaw resides in adm1266_nvmem_read_blackbox(), which reads blackbox records from an ADM1266 power supply sequencer over PMBus. A malicious or malfunctioning device can return more bytes than the driver expects, overflowing the dev_mem buffer by up to 191 bytes before the length check rejects the response. The vulnerability was resolved by bouncing each record through a protocol-sized 255-byte local buffer prior to copying only ADM1266_BLACKBOX_SIZE (64) bytes into the destination slot.

Critical Impact
A compromised or malicious PMBus device can trigger a heap out-of-bounds write in kernel memory, enabling potential kernel memory corruption and privilege escalation on affected Linux systems.

Affected Products

Linux kernel builds including the pmbus/adm1266 hwmon driver
Systems using ADM1266 power supply sequencer hardware over PMBus/I2C
Multiple upstream and stable kernel branches referenced in the kernel.org fix commits

Discovery Timeline

2026-07-19 - CVE-2026-64085 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64085

Vulnerability Analysis

The vulnerability originates in the adm1266_pmbus_block_xfer() helper, which copies device-supplied block payloads into a caller-provided buffer using a device-supplied length. The helper executes memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]) without knowing the size of data_r, trusting the device to return no more than one record's worth of bytes.

The caller, adm1266_nvmem_read_blackbox(), walks read_buff through the data->dev_mem allocation in ADM1266_BLACKBOX_SIZE (64-byte) strides. However, the helper is prepared to write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. This mismatch between the stride size and the helper's maximum write capacity creates the overflow condition.

When the device returns more than 64 bytes on the trailing record, at read_buff offset 1984 within the 2048-byte dev_mem allocation, the write extends up to 191 bytes past the allocation. The subsequent length validation if (ret != ADM1266_BLACKBOX_SIZE) return -EIO; runs only after the overflow has already occurred.

Root Cause

The root cause is a boundary mismatch between the helper's maximum write size and the caller's expected record stride, combined with implicit trust in a device-supplied length field. The vulnerable code fails to validate the returned length before performing the memory copy, allowing a malicious or faulty PMBus device to dictate an out-of-bounds write into the kernel heap.

Attack Vector

Exploitation requires the ability to influence responses from the ADM1266 PMBus device. This typically means physical access, a compromised firmware image, or an attacker positioned to manipulate I2C bus traffic. A crafted device response containing a length field greater than 64 on the trailing blackbox record triggers the overflow. The overflow corrupts kernel heap memory adjacent to dev_mem, potentially enabling privilege escalation or kernel denial of service.

The fix constrains the overflow within the caller by reading each record into a 255-byte local bounce buffer that matches the helper's maximum output. The length is validated before exactly ADM1266_BLACKBOX_SIZE bytes are copied into the dev_mem slot. See the Kernel Git Commit Fix for the upstream patch.

Detection Methods for CVE-2026-64085

Indicators of Compromise

Unexpected kernel oops, KASAN reports, or slab corruption warnings referencing adm1266_nvmem_read_blackbox or adm1266_pmbus_block_xfer
Kernel log entries indicating -EIO returns from adm1266 blackbox read paths accompanied by memory corruption traces
Anomalous PMBus block read responses exceeding 64 bytes on ADM1266 hardware

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface out-of-bounds writes in the adm1266 driver during runtime
Audit deployed kernel versions against the fix commits listed on kernel.org to identify unpatched builds
Monitor kernel ring buffer output via dmesg for hwmon driver anomalies on systems using ADM1266 sequencers

Monitoring Recommendations

Collect kernel crash dumps and panic logs from systems with PMBus power sequencer hardware for offline analysis
Track kernel package versions across the fleet and flag hosts running kernels predating the referenced stable fix commits
Integrate kernel telemetry into centralized logging to correlate hardware-driver anomalies with security events

How to Mitigate CVE-2026-64085

Immediate Actions Required

Update to a Linux kernel version containing the adm1266 bounce-buffer fix from the referenced kernel.org commits
Inventory systems using ADM1266 hardware and prioritize patch deployment on those hosts
Restrict physical and firmware-level access to systems exposing PMBus/I2C interfaces to reduce the attack surface

Patch Information

The upstream fix is available across multiple stable branches. Relevant commits include 43cae21424ff, 6098634cfa71, 60c4b9fe1a3d, 7896d87cbb05, 83e039f0a43e, 97a9cf2a8217, 9d5309500b46, and dd47b8c4a0a8. Apply the patched kernel from your distribution's security channel.

Workarounds

If patching is not immediately feasible, blacklist the adm1266 kernel module on systems where the sequencer is not required using /etc/modprobe.d/
Limit access to sysfs and nvmem entries exposed by the adm1266 driver to trusted administrative accounts only
Consider unbinding the driver from the affected device via sysfs until a patched kernel is deployed

bash

# Blacklist the adm1266 module until a patched kernel is available
echo "blacklist adm1266" | sudo tee /etc/modprobe.d/blacklist-adm1266.conf
sudo modprobe -r adm1266

# Verify the module is not loaded
lsmod | grep adm1266