Threats Tagged 'cve-2026-64085'

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer adm1266_pmbus_block_xfer() copies the device-supplied block payload into the caller-provided buffer using the device-supplied length: memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]); The helper does not know how large data_r is and trusts the device to return at most one record's worth of bytes. adm1266_nvmem_read_blackbox() violates that contract: it advances read_buff inside data->dev_mem in ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes. A device that returns more than 64 bytes on the trailing record (read_buff offset 1984 in the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes before the post-call if (ret != ADM1266_BLACKBOX_SIZE) return -EIO; can reject the response. Contain the fix in the caller without changing the helper signature: read each record into a 255-byte local bounce buffer that matches the helper's maximum output, validate the returned length, and only then copy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot.

A vulnerability in the Linux kernel's hwmon subsystem (pmbus/adm1266 driver) involves improper handling of device-supplied block payloads. The adm1266_pmbus_block_xfer() function copies data based on a device-supplied length without verifying buffer boundaries, which can lead to a buffer overflow in the device memory area. The issue arises because the caller advances the read buffer in fixed 64-byte strides, but the helper function can write up to 255 bytes, potentially overflowing the allocated memory by up to 191 bytes. The fix involves reading data into a local buffer matching the maximum allowed size, validating length, and then copying only the expected fixed-size data into the device memory buffer.