The Linux kernel vulnerability CVE-2026-64083 affects the hwmon pmbus/adm1266 driver where adm1266_gpio_get() and adm1266_gpio_get_multiple() functions improperly handle short block-read responses from devices. These functions compose a pin-status word from a buffer returned by i2c_smbus_read_block_data() without verifying the response length beyond checking for error returns. If a device returns fewer than the expected 2 bytes (0 or 1 byte), uninitialized stack memory is used in the pin-status word, which is then exposed to userspace via gpiolib interfaces. The vulnerability allows leakage of kernel stack bits per request from devices with firmware glitches, bus errors, or malicious behavior. The fix adds missing length checks and surfaces short responses as I/O errors (-EIO).

This vulnerability can lead to information leakage of kernel stack memory to userspace processes via GPIO status reads. The leaked data could potentially expose sensitive kernel memory contents. However, there are no known exploits in the wild, and the impact is limited to leaking a few bits of kernel stack per request. It does not allow direct code execution or privilege escalation based on the provided data.

A fix has been implemented in the Linux kernel to add proper length checks on block-read responses in the adm1266 GPIO accessors, returning errors on short responses. Users should update to a Linux kernel version that includes this fix. Since this is not a cloud service, remediation depends on applying the official kernel patch or upgrading to a fixed kernel release. Patch status is not explicitly confirmed here; check the vendor or kernel mailing lists for the fixed version and apply the update accordingly.