CVE-2026-64087: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64087 Overview

CVE-2026-64087 is a Linux kernel vulnerability in the hwmonpmbus/adm1266 driver. The function adm1266_nvmem_read_blackbox() trusts a record_count value read directly from byte 3 of the BLACKBOX_INFO PMBus response. The destination buffer data->dev_mem is fixed at 2048 bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE = 32 * 64). A device reporting a record_count greater than 32 drives read_buff past the end of dev_mem, producing an out-of-bounds write. The condition can arise from firmware bugs, PMBus bus corruption, or a non-responsive slave returning 0xff. The fix caps record_count at ADM1266_BLACKBOX_MAX_RECORDS and returns -EIO on larger values.

Critical Impact
A malformed or malicious PMBus BLACKBOX_INFO response can trigger a kernel heap out-of-bounds write, leading to memory corruption and potential denial of service on affected Linux systems using the ADM1266 power sequencer.

Affected Products

Linux kernel branches shipping the hwmonpmbus/adm1266 driver prior to the fix commits
Systems using the Analog Devices ADM1266 power sequencer exposed via PMBus
Distributions consuming the affected stable kernel branches referenced in the patch series

Discovery Timeline

2026-07-19 - CVE-2026-64087 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64087

Vulnerability Analysis

The defect is an out-of-bounds write in the ADM1266 hwmon driver's blackbox NVMEM read path. adm1266_nvmem_read_blackbox() iterates a loop bounded by record_count, a value obtained from byte 3 of the BLACKBOX_INFO PMBus response. Each iteration advances read_buff by ADM1266_BLACKBOX_SIZE (64 bytes) inside data->dev_mem, which is allocated for a maximum of 32 records (2048 bytes total). When the reported record_count exceeds 32, later iterations write past the end of the allocation. The impact class is memory corruption in kernel space, which typically manifests as denial of service through kernel panics or subtle heap corruption affecting adjacent allocations.

Root Cause

The root cause is missing input validation on data returned by an external hardware peripheral. The driver treated the PMBus response as trusted and used its byte 3 field as an unchecked loop bound. Any of three real-world conditions can produce an implausible value: firmware defects in the ADM1266, transient corruption on the SMBus/PMBus wire, or an absent slave returning 0xff for all reads (giving record_count = 255).

Attack Vector

Exploitation requires the ability to influence data returned from the ADM1266 device on the PMBus, or to induce bus faults that make the driver observe a spurious record_count. The vulnerable code path executes when userspace or another kernel component reads the driver's NVMEM cell. This is primarily a local or hardware-adjacent vulnerability rather than a network-reachable one, and severity is unrated in NVD at the time of publication. The current EPSS probability is 0.184%.

No verified public exploit code is available. The vulnerability mechanism is straightforward: the loop writes ADM1266_BLACKBOX_SIZE bytes per iteration into data->dev_mem and continues past the 2048-byte boundary whenever the attacker-influenced record_count exceeds 32. See the referenced kernel commits for the exact source-level change.

Detection Methods for CVE-2026-64087

Indicators of Compromise

Kernel log entries showing -EIO returned from adm1266_nvmem_read_blackbox() after the patch is applied, indicating a device that previously could have triggered the overflow.
Kernel oops, panic, or KASAN slab-out-of-bounds reports referencing the adm1266 driver or dev_mem allocation.
Repeated PMBus transaction errors or 0xff reads correlated with reads of the ADM1266 blackbox NVMEM cell.

Detection Strategies

Inventory hosts that load the adm1266 module (lsmod | grep adm1266) and cross-reference their kernel versions against the fix commits listed in the references.
Enable KASAN in test kernels to surface any out-of-bounds writes triggered by hardware fault injection or fuzzing of PMBus responses.
Monitor dmesg and centralized log collection for hwmon, pmbus, or adm1266 error strings.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on adm1266 error patterns, unexpected -EIO returns, and kernel oops signatures.
Track kernel package versions across the fleet and flag any host still running an unpatched branch that ships the adm1266 driver.
Correlate hardware health telemetry (I2C/PMBus error counters) with kernel-side driver errors to identify misbehaving power sequencers early.

How to Mitigate CVE-2026-64087

Immediate Actions Required

Apply the stable kernel updates containing the referenced fix commits, including 0e791cd0140, 231db52a5b6, 4afca954622, 5469e1e7c41, 75c862adf3d, adcb163ad7c, c2c56092710, and f85c81e93dbd.
On systems where no ADM1266 hardware is present, unload the adm1266 module and blacklist it to eliminate the code path entirely.
Validate hardware health of ADM1266 devices exhibiting PMBus errors, since bus faults can trigger the vulnerable path.

Patch Information

The fix introduces a bound check that caps record_count at ADM1266_BLACKBOX_MAX_RECORDS (32) before entering the loop and returns -EIO for any larger value. See the kernel commits: 0e791cd0140, 231db52a5b6, 4afca954622, 5469e1e7c41, 75c862adf3d, adcb163ad7c, c2c56092710, and f85c81e93dbd.

Workarounds

Blacklist the adm1266 module on hosts that do not require ADM1266 power sequencer telemetry to remove the vulnerable code from the loaded kernel.
Restrict physical and firmware-level access to systems containing ADM1266 devices to reduce the chance of a hostile or corrupted BLACKBOX_INFO response.
Avoid reading the ADM1266 NVMEM blackbox cell from userspace on unpatched kernels until the fix is applied.

bash

# Verify whether the adm1266 driver is loaded and blacklist if unused
lsmod | grep adm1266
echo 'blacklist adm1266' | sudo tee /etc/modprobe.d/blacklist-adm1266.conf
sudo depmod -a

# Confirm running kernel version against fixed stable branches
uname -r