CVE-2026-64085

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer<br /> <br /> adm1266_pmbus_block_xfer() copies the device-supplied block payload<br /> into the caller-provided buffer using the device-supplied length:<br /> <br /> memcpy(data_r, &amp;msgs[1].buf[1], msgs[1].buf[0]);<br /> <br /> The helper does not know how large data_r is and trusts the device to<br /> return at most one record&amp;#39;s worth of bytes. adm1266_nvmem_read_blackbox()<br /> violates that contract: it advances read_buff inside data-&gt;dev_mem in<br /> ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to<br /> write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns<br /> more than 64 bytes on the trailing record (read_buff offset 1984 in<br /> the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes<br /> before the post-call<br /> <br /> if (ret != ADM1266_BLACKBOX_SIZE)<br /> return -EIO;<br /> <br /> can reject the response.<br /> <br /> Contain the fix in the caller without changing the helper signature:<br /> read each record into a 255-byte local bounce buffer that matches the<br /> helper&amp;#39;s maximum output, validate the returned length, and only then<br /> copy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot.