The Linux kernel hwmon driver for pmbus/adm1266 used a fixed 5-byte stack buffer in adm1266_nvmem_read_blackbox() to read SMBus block data via i2c_smbus_read_block_data(). However, i2c_smbus_read_block_data() copies the number of bytes indicated by the device's length byte, which can be up to I2C_SMBUS_BLOCK_MAX (32 bytes). This mismatch allows a stack buffer overflow if the device returns more than 5 bytes before the function's post-call length check can reject the response. The vulnerability is addressed by widening the local buffer to I2C_SMBUS_BLOCK_MAX, aligning with other driver calls and preventing overflow.

The vulnerability can cause a stack buffer overflow leading to potential denial of service (kernel crash) or other undefined behavior. The CVSS score rates this as medium severity with no confidentiality or integrity impact but high impact on availability. There are no known exploits in the wild. The vulnerability requires local access with low privileges and no user interaction.

A fix has been implemented in the Linux kernel by increasing the buffer size to I2C_SMBUS_BLOCK_MAX to prevent overflow. Users should update to a kernel version that includes this patch. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. No additional mitigations are indicated.