The vulnerability in the Linux kernel hwmon pmbus/adm1266 driver involved a mismatch between the buffer size allocated for reading data and the amount of data the i2c controller was instructed to write. Specifically, adm1266_pmbus_block_xfer() set the read transaction length to ADM1266_PMBUS_BLOCK_MAX + 2 bytes, but the buffer read_buf was declared with only ADM1266_PMBUS_BLOCK_MAX + 1 bytes. This caused a one-byte buffer overflow when handling maximum-length block responses (length byte = 255 plus one PEC byte). Additionally, the PEC comparison read beyond the buffer boundary. The fix was to increase the buffer size to ADM1266_PMBUS_BLOCK_MAX + 2 bytes to safely hold the length byte, payload, and PEC byte.

This vulnerability allows a one-byte buffer overflow in kernel memory when processing maximum-length pmbus block read responses. Such an overflow can lead to memory corruption, potentially causing kernel instability or enabling privilege escalation. However, no known exploits are reported in the wild at this time.

A fix has been implemented in the Linux kernel by increasing the size of the read buffer in the adm1266 driver to prevent the buffer overflow. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and patch availability.