CVE-2026-64086: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64086 Overview

CVE-2026-64086 is an out-of-bounds write vulnerability in the Linux kernel's hwmon subsystem, specifically in the pmbus/adm1266 driver. The flaw exists in adm1266_pmbus_block_xfer(), which configures an I2C read transaction with a length of ADM1266_PMBUS_BLOCK_MAX + 2 bytes while the destination buffer read_buf is declared as ADM1266_PMBUS_BLOCK_MAX + 1 bytes. A maximum-length block response causes the I2C controller to write 257 bytes into a 256-byte buffer, corrupting kernel memory adjacent to read_buf. The subsequent Packet Error Code (PEC) comparison also reads one byte past the array bounds.

Critical Impact
A local, low-privileged actor with access to an affected system can trigger a kernel heap out-of-bounds write through the ADM1266 power sequencer driver, potentially leading to memory corruption, privilege escalation, or denial of service.

Affected Products

Linux kernel versions containing the hwmonpmbus/adm1266 driver prior to the referenced fix commits
Systems using Analog Devices ADM1266 cascadable super sequencer hardware
Distributions shipping vulnerable stable kernel branches referenced in the kernel.org commits

Discovery Timeline

2026-07-19 - CVE-2026-64086 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64086

Vulnerability Analysis

The vulnerability resides in drivers/hwmon/pmbus/adm1266.c. The function adm1266_pmbus_block_xfer() prepares an i2c_msg structure that instructs the I2C controller to receive up to ADM1266_PMBUS_BLOCK_MAX + 2 bytes. This accounts for one length byte, up to 255 payload bytes, and one PEC byte. However, the backing storage read_buf in struct adm1266_data is only sized ADM1266_PMBUS_BLOCK_MAX + 1, which is one byte too small.

When the device returns a maximum-length block response, the I2C subsystem writes 257 bytes into the 256-byte buffer. This constitutes a one-byte kernel heap out-of-bounds write. The subsequent CRC check at msgs[1].buf[msgs[1].buf[0] + 1] also performs an out-of-bounds read on the same buffer. Both conditions represent classic buffer boundary miscalculations [CWE-787] and [CWE-125].

Root Cause

The root cause is a mismatch between the declared buffer size and the length field passed to the I2C transfer. The developer sized read_buf to accommodate the length byte plus the maximum payload, but omitted space for the optional PEC trailer that the transfer length explicitly reserves. This is a boundary condition error where two constants that must remain synchronized diverged.

Attack Vector

Exploitation requires local access with permissions to interact with the affected I2C or hwmon device node. An attacker capable of influencing or emulating responses from the ADM1266 hardware, or an attacker triggering a full-length block read through the sysfs interface, can induce the overflow. Because the write lands in kernel heap memory adjacent to struct adm1266_data, corruption of neighboring kernel objects becomes possible. The fix bumps the read_buf declaration to ADM1266_PMBUS_BLOCK_MAX + 2 so it can hold the length byte, the full 255-byte payload, and the PEC byte that the i2c_msg length already accounts for. No public exploit or proof-of-concept is currently available.

Detection Methods for CVE-2026-64086

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN slab-out-of-bounds reports referencing adm1266_pmbus_block_xfer or pmbus_read_block_data
Anomalous I2C bus errors or repeated PEC mismatches logged against ADM1266 devices
Kernel log entries indicating heap corruption in the hwmon subsystem on systems with ADM1266 hardware

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface the out-of-bounds write during hwmon interaction
Audit installed kernel versions against the stable commits listed in the kernel.org references to identify unpatched systems
Monitor dmesg output for stack traces originating from the pmbus/adm1266 driver path

Monitoring Recommendations

Track kernel crash and oops telemetry from hosts equipped with ADM1266 power sequencers, typically found in server and networking hardware
Alert on unexpected process access to /sys/class/hwmon/* and /dev/i2c-* device nodes by non-root or non-hardware-management users
Correlate kernel memory corruption signals with subsequent privilege escalation indicators

How to Mitigate CVE-2026-64086

Immediate Actions Required

Apply the stable kernel updates referenced in the kernel.org commits that resize read_buf to ADM1266_PMBUS_BLOCK_MAX + 2
Restrict access to /dev/i2c-* and hwmon sysfs entries to trusted administrative users only
Inventory systems using ADM1266 hardware and prioritize patching those hosts

Patch Information

The upstream fix modifies the read_buf declaration in struct adm1266_data to ADM1266_PMBUS_BLOCK_MAX + 2, aligning the buffer size with the I2C transfer length. The fix has been backported across multiple stable branches. Relevant commits include 2279c342d94e, 397d3f523bff, 472744f69d25, 487566cb1ccd, 528a9f88e885, a6c802145a8d, bd5be3fa5de6, and d94ceb16e55b.

Workarounds

Unload or blacklist the adm1266 kernel module on systems where the sensor is not required for operation
Tighten permissions on /dev/i2c-* and hwmon interfaces so only privileged administrative accounts can issue block reads
Deploy kernel hardening options such as SLUB_DEBUG and CONFIG_HARDENED_USERCOPY to reduce the exploitability of adjacent heap corruption

bash

# Blacklist the vulnerable module until the kernel is patched
echo "blacklist adm1266" | sudo tee /etc/modprobe.d/blacklist-adm1266.conf
sudo rmmod adm1266 2>/dev/null || true

# Restrict access to I2C device nodes
sudo chmod 600 /dev/i2c-*
sudo chown root:root /dev/i2c-*