CVE-2026-64135: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64135 Overview

CVE-2026-64135 is a stack buffer overflow vulnerability in the Linux kernel's hwmon subsystem, specifically in the pmbus/adm1266 driver. The function adm1266_nvmem_read_blackbox() declares a 5-byte stack buffer and passes it to i2c_smbus_read_block_data() to retrieve a 4-byte BLACKBOX_INFO response. Because i2c_smbus_read_block_data() does not honor caller buffer sizes, a device returning a block length above 5 overflows the caller's stack buffer before the length check can reject the response. The upstream fix widens the local buffer to I2C_SMBUS_BLOCK_MAX (32 bytes) to match convention used by other callers in this driver.

Critical Impact
A malicious or malfunctioning SMBus/I2C device connected to a system using the adm1266 PMBus hwmon driver can trigger a kernel stack buffer overflow, potentially leading to kernel memory corruption or denial of service.

Affected Products

Linux kernel builds including the pmbus/adm1266 hwmon driver prior to the fix
Systems using the Analog Devices ADM1266 cascadable super sequencer over SMBus/I2C
Distributions shipping the affected kernel versions across the referenced stable branches

Discovery Timeline

2026-07-19 - CVE-2026-64135 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64135

Vulnerability Analysis

The vulnerability resides in adm1266_nvmem_read_blackbox() within the Linux kernel's PMBus hwmon driver for the ADM1266 power sequencer. The function allocates a 5-byte on-stack buffer sized for the expected 4-byte BLACKBOX_INFO payload plus a length byte. It then invokes i2c_smbus_read_block_data() to retrieve the response from the device over SMBus.

The SMBus helper i2c_smbus_read_block_data() does not accept a buffer length argument. It performs a memcpy(values, &data.block[1], data.block[0]), where data.block[0] is the length byte returned by the slave device. That length is bounded only by I2C_SMBUS_BLOCK_MAX, which is 32 bytes. If the device returns any length greater than 5, the copy writes past the caller's stack buffer before the driver's post-call if (ret != 4) return -EIO; guard can reject the malformed response.

This is a classic stack-based buffer overflow [CWE-121] triggered by untrusted device input on the SMBus. Because the overflow targets kernel stack memory, corruption of adjacent stack frames, saved registers, or return addresses becomes possible on kernels without full stack protection.

Root Cause

The root cause is a mismatch between the caller-provided buffer size and the length field controlled by the SMBus slave. The driver assumed the device would return exactly 4 payload bytes, and sized the stack buffer to 5 bytes accordingly. However, i2c_smbus_read_block_data() trusts the device-reported length up to I2C_SMBUS_BLOCK_MAX and copies that many bytes regardless of caller capacity.

Attack Vector

Exploitation requires an attacker-controlled or faulty SMBus/I2C peripheral responding at the ADM1266 address, or the ability to influence responses on that bus. Physical or firmware-level access to the I2C bus is typically required, since SMBus is a local hardware transport. A malicious device returning a block length between 6 and 32 for the BLACKBOX_INFO query causes the overflow. Impact ranges from kernel panic to potential kernel memory corruption depending on stack layout and kernel hardening features.

No verified public proof-of-concept code is available. See the upstream commit references for the exact patched code path.

Detection Methods for CVE-2026-64135

Indicators of Compromise

Unexpected kernel oops, panic, or stack corruption messages referencing adm1266_nvmem_read_blackbox or the pmbus_core module
Kernel stack protector reports (Kernel stack is corrupted in: adm1266_nvmem_read_blackbox) in dmesg
Anomalous SMBus block read responses to BLACKBOX_INFO returning lengths greater than 4 bytes

Detection Strategies

Inventory systems that load the adm1266 kernel module and correlate against installed kernel versions to identify unpatched hosts
Monitor kernel logs for hwmon and PMBus driver errors that could indicate malformed device responses or exploit attempts
Use configuration management tooling to detect kernel builds that predate the referenced stable-tree commits

Monitoring Recommendations

Ship dmesg and /var/log/kern.log to a centralized logging or SIEM platform for pattern matching on driver crashes
Alert on repeated I2C or SMBus transaction failures on buses hosting an ADM1266 device
Track kernel package versions across the fleet and flag hosts still running affected kernels

How to Mitigate CVE-2026-64135

Immediate Actions Required

Update to a Linux kernel that includes the upstream fix widening the blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
Identify systems using the ADM1266 power sequencer and prioritize patching on hardware exposing SMBus to untrusted components
Restrict physical and firmware-level access to systems whose SMBus is accessible from lower-privilege domains such as BMCs or add-in cards

Patch Information

The fix is available in the upstream stable trees. Relevant commits include Kernel Commit 0dbf64c5, Kernel Commit 2b7a698d, Kernel Commit 33251abb, Kernel Commit 6ed16a40, Kernel Commit 7f705e58, Kernel Commit ba09f4ba, Kernel Commit ca560f75, and Kernel Commit eee213da. Apply the vendor-provided kernel update for your distribution.

Workarounds

If the ADM1266 device is not required, blacklist the adm1266 kernel module to prevent the vulnerable code path from loading
Where feasible, isolate the SMBus segment carrying the ADM1266 from devices or firmware paths that could be attacker-influenced
Enable kernel hardening options such as CONFIG_STACKPROTECTOR_STRONG and CONFIG_FORTIFY_SOURCE to reduce exploitability of stack overflows

bash

# Blacklist the vulnerable module until the kernel is patched
echo 'blacklist adm1266' | sudo tee /etc/modprobe.d/blacklist-adm1266.conf
sudo update-initramfs -u

# Verify the module is not loaded after reboot
lsmod | grep adm1266