CVE-2026-64087
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
hwmon: (pmbus/adm1266) reject implausible blackbox record_count
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) reject implausible blackbox record_count adm1266_nvmem_read_blackbox() loops over a record_count that comes straight from byte 3 of the BLACKBOX_INFO response. The destination buffer is data->dev_mem, sized for the nvmem cell's declared 2048 bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE = 32 * 64). A device that reports a record_count greater than 32 -- whether due to firmware bugs, bus corruption, or a non-responsive slave returning 0xff -- would walk read_buff past the end of the dev_mem allocation on the trailing iterations. Cap record_count at ADM1266_BLACKBOX_MAX_RECORDS (introduced here) before entering the loop and return -EIO on any larger value, so a malformed BLACKBOX_INFO response cannot drive the loop out of bounds.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 15609d1893020436e1e8ccfd9ded774a96dd17a2 | affected | git | adcb163ad7cacca317872fc62bd8885e842e45e3 | Unavailable | None listed |
| 15609d1893020436e1e8ccfd9ded774a96dd17a2 | affected | git | c2c56092710fe8a893b67b5a3d7e62808d02d84d | Unavailable | None listed |
| 15609d1893020436e1e8ccfd9ded774a96dd17a2 | affected | git | 5469e1e7c411acc15fdd8262c99c3ebd9defd594 | Unavailable | None listed |
| 15609d1893020436e1e8ccfd9ded774a96dd17a2 | affected | git | f85c81e93dbd6915970bd5f3bffcf62633c4c54c | Unavailable | None listed |
| 15609d1893020436e1e8ccfd9ded774a96dd17a2 | affected | git | 0e791cd0140fb136083565aadfbe0f705aa260d0 | Unavailable | None listed |
| 15609d1893020436e1e8ccfd9ded774a96dd17a2 | affected | git | 75c862adf3d3caab4f49bb3530723c215376e37c | Unavailable | None listed |
| 15609d1893020436e1e8ccfd9ded774a96dd17a2 | affected | git | 231db52a5b64d0a9769e298dadc148e1f79b26a6 | Unavailable | None listed |
| 15609d1893020436e1e8ccfd9ded774a96dd17a2 | affected | git | 4afca954622d672ea65ed961bed01cf91caa034e | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.10 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.10 | Unavailable | None listed |
| 5.10.258 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.209 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.175 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.142 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.92 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.34 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.0.11 | unaffected | semver | Unavailable | 7.0.* | None listed |
| 7.1 | unaffected | original_commit_for_fix | Unavailable | * | None listed |