In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR… (CVE-2026-64084)
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) { ... } where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR = 25. gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip), so the iteration walks find_next_bit() up to 242, reading up to 217 extra bits (a handful of unsigned-long words: four on 64-bit, seven on 32-bit) of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds. Substitute ADM1266_PDIO_NR for the constant so the scan stops at the last real PDIO bit.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-64084 involves the adm1266 driver in the hwmon subsystem. The function adm1266_gpio_get_multiple() incorrectly iterates over a bitmask using ADM1266_PDIO_STATUS (a PMBus command code 0xE9) as the upper bound instead of ADM1266_PDIO_NR, the actual number of PDIO pins (25). This causes the iteration to exceed the mask size, resulting in out-of-bounds reads of up to 217 bits beyond the mask and corresponding out-of-bounds writes to the bits array. The fix replaces the incorrect constant with ADM1266_PDIO_NR to limit the scan correctly.
Potential Impact
The vulnerability allows out-of-bounds memory access in kernel space, including reading unintended stack memory and writing beyond allocated arrays. This could potentially lead to memory corruption or instability in the kernel, but no known exploits in the wild have been reported. The exact impact depends on how the out-of-bounds memory is used or triggered.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel releases and apply updates that address CVE-2026-64084 when available. Until patched, avoid using vulnerable kernel versions if possible.
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR… (CVE-2026-64084)
Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) { ... } where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR = 25. gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip), so the iteration walks find_next_bit() up to 242, reading up to 217 extra bits (a handful of unsigned-long words: four on 64-bit, seven on 32-bit) of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds. Substitute ADM1266_PDIO_NR for the constant so the scan stops at the last real PDIO bit.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-64084 involves the adm1266 driver in the hwmon subsystem. The function adm1266_gpio_get_multiple() incorrectly iterates over a bitmask using ADM1266_PDIO_STATUS (a PMBus command code 0xE9) as the upper bound instead of ADM1266_PDIO_NR, the actual number of PDIO pins (25). This causes the iteration to exceed the mask size, resulting in out-of-bounds reads of up to 217 bits beyond the mask and corresponding out-of-bounds writes to the bits array. The fix replaces the incorrect constant with ADM1266_PDIO_NR to limit the scan correctly.
Potential Impact
The vulnerability allows out-of-bounds memory access in kernel space, including reading unintended stack memory and writing beyond allocated arrays. This could potentially lead to memory corruption or instability in the kernel, but no known exploits in the wild have been reported. The exact impact depends on how the out-of-bounds memory is used or triggered.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel releases and apply updates that address CVE-2026-64084 when available. Until patched, avoid using vulnerable kernel versions if possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m232-p3mf-6xc5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64084"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a92a4a8d598912c218
Added to database: 07/19/2026, 19:38:17 UTC
Last enriched: 07/19/2026, 19:51:50 UTC
Last updated: 07/20/2026, 19:41:22 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.