Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-64085— hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于adm1266_pmbus_block_xfer()函数信任设备提供的长度，但adm1266_nvmem_read_blackbox()违反约定，在dev_mem分配中以64字节步长前进，而helper可写入255字节，导致设备返回超过64字节的尾部记录时，dev_mem发生最多191字节的缓冲区溢出。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.22% · P12

Possible ATT&CK Techniques 1 AI

T1205.001 · Port Knocking

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 407dc802a9c0809ca6a48de4b4c63305eb84ef56< 7896d87cbb05e097efc113243d4e38f9f8cea16c affected
407dc802a9c0809ca6a48de4b4c63305eb84ef56< 9d5309500b4607b7198e19f0a3fa13eb864cd5fb affected
407dc802a9c0809ca6a48de4b4c63305eb84ef56< 6098634cfa711f11a8d65368dc51ec8f7c8241ba affected
407dc802a9c0809ca6a48de4b4c63305eb84ef56< 60c4b9fe1a3dd012014b1f561a6928a0b5db1126 affected
407dc802a9c0809ca6a48de4b4c63305eb84ef56< 83e039f0a43e0708515b0479cb7690fb93faaaa0 affected
407dc802a9c0809ca6a48de4b4c63305eb84ef56< 97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f affected
407dc802a9c0809ca6a48de4b4c63305eb84ef56< dd47b8c4a0a8ced442da3f008db28fbbd31feaf0 affected
407dc802a9c0809ca6a48de4b4c63305eb84ef56< 43cae21424ff8e33894a0f86c6b80b840c049fd7 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64085

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer adm1266_pmbus_block_xfer() copies the device-supplied block payload into the caller-provided buffer using the device-supplied length: memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]); The helper does not know how large data_r is and trusts the device to return at most one record's worth of bytes. adm1266_nvmem_read_blackbox() violates that contract: it advances read_buff inside data->dev_mem in ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns more than 64 bytes on the trailing record (read_buff offset 1984 in the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes before the post-call if (ret != ADM1266_BLACKBOX_SIZE) return -EIO; can reject the response. Contain the fix in the caller without changing the helper signature: read each record into a 255-byte local bounce buffer that matches the helper's maximum output, validate the returned length, and only then copy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于adm1266_pmbus_block_xfer()函数信任设备提供的长度，但adm1266_nvmem_read_blackbox()违反约定，在dev_mem分配中以64字节步长前进，而helper可写入255字节，导致设备返回超过64字节的尾部记录时，dev_mem发生最多191字节的缓冲区溢出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 407dc802a9c0809ca6a48de4b4c63305eb84ef56 ~ 7896d87cbb05e097efc113243d4e38f9f8cea16c -
Linux Linux 5.10 -

II. Public POCs for CVE-2026-64085

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64085

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64085 (6)

Same Patch Batch · Linux · 2026-07-19 · 429 CVEs total

CVE-2026-63795 10.0 CRITICAL 9p: avoid putting oldfid in p9_client_walk() error path
CVE-2026-63887 9.8 CRITICAL scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
CVE-2026-63994 9.8 CRITICAL tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
CVE-2026-64035 9.8 CRITICAL igc: set tx buffer type for SMD frames
CVE-2026-64142 9.8 CRITICAL ksmbd: close durable scavenger races against m_fp_list lookups
CVE-2026-63993 9.8 CRITICAL vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
CVE-2026-53399 9.8 CRITICAL nfsd: release layout stid on setlease failure
CVE-2026-53398 9.8 CRITICAL NFSD: Fix SECINFO_NO_NAME decode error cleanup
CVE-2026-63825 9.8 CRITICAL gcov: use atomic counter updates to fix concurrent access crashes
CVE-2026-64025 9.8 CRITICAL bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
CVE-2026-64033 9.8 CRITICAL RDMA/rtrs: Fix use-after-free in path file creation cleanup
CVE-2026-63886 9.8 CRITICAL scsi: target: iscsi: Validate CHAP_R length before base64 decode
CVE-2026-64125 9.8 CRITICAL net: bcmgenet: keep RBUF EEE/PM disabled
CVE-2026-64091 9.8 CRITICAL batman-adv: tt: fix TOCTOU race for reported vlans
CVE-2026-63808 9.8 CRITICAL exfat: fix potential use-after-free in exfat_find_dir_entry()
CVE-2026-63978 9.8 CRITICAL net/handshake: Drain pending requests at net namespace exit
CVE-2026-63979 9.8 CRITICAL net/handshake: hand off the pinned file reference to accept_doit
CVE-2026-64132 9.8 CRITICAL ipv6: ioam: refresh hdr pointer before ioam6_event()
CVE-2026-64136 9.8 CRITICAL smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
CVE-2026-63800 9.8 CRITICAL pNFS: Fix use-after-free in pnfs_update_layout()

Showing top 20 of 429 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64085

No comments yet

Leave a comment