hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
Summary
| CVE | CVE-2026-64083 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-19 16:17:48 UTC |
| Updated | 2026-07-30 14:59:47 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors adm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the pin-status word as pins_status = read_buf[0] + (read_buf[1] << 8); right after i2c_smbus_read_block_data(), guarding only against an error return. A well-behaved device returns 2 bytes for GPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or 1-byte response too. If the device returns 0 bytes, both read_buf slots are uninitialized stack memory; if it returns 1 byte, read_buf[1] is. The composed value then flows through set_bit() into the caller's *bits in adm1266_gpio_get_multiple(), or into the return value of adm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and the char-dev ioctls). That leaks a few bits of kernel stack per request on any device whose firmware glitch, bus error, or hostile slave produces a short block-read response. Add the missing length check to both call sites and surface a short response as -EIO. |
Risk And Classification
EPSS: 0.001840000 probability, percentile 0.082970000 (date 2026-08-02)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected d98dfad35c38c037b37c4adc99df01da571031a5 fd9196aad9e5a3845cea17de3405ebc700382142 git | Not specified |
| CNA | Linux | Linux | affected d98dfad35c38c037b37c4adc99df01da571031a5 ee4799becf7d2af3778007e22c2e55c4009a49c7 git | Not specified |
| CNA | Linux | Linux | affected d98dfad35c38c037b37c4adc99df01da571031a5 c603b6c6840ac0c6285f5eefea0de6242710af21 git | Not specified |
| CNA | Linux | Linux | affected d98dfad35c38c037b37c4adc99df01da571031a5 a2d1c819348b36fccbbfcf37c5fa7a50a9b4528f git | Not specified |
| CNA | Linux | Linux | affected d98dfad35c38c037b37c4adc99df01da571031a5 ae25cf2ea9ebd06d7ad416647dbdc7b5d0172946 git | Not specified |
| CNA | Linux | Linux | affected d98dfad35c38c037b37c4adc99df01da571031a5 eb3cd9bb590460c6127145cb245be925d23f5232 git | Not specified |
| CNA | Linux | Linux | affected d98dfad35c38c037b37c4adc99df01da571031a5 64fa9328948ddcc0f7f3c23ea1756c126d9dffac git | Not specified |
| CNA | Linux | Linux | affected d98dfad35c38c037b37c4adc99df01da571031a5 a7232f68c43ca62f545049b7f5fbfc75137b843b git | Not specified |
| CNA | Linux | Linux | affected 5.10 | Not specified |
| CNA | Linux | Linux | unaffected 5.10 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.10.258 5.10.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.209 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.175 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.142 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.92 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.34 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.0.11 7.0.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/a2d1c819348b36fccbbfcf37c5fa7a50a9b4528f | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/fd9196aad9e5a3845cea17de3405ebc700382142 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/c603b6c6840ac0c6285f5eefea0de6242710af21 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/a7232f68c43ca62f545049b7f5fbfc75137b843b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/ee4799becf7d2af3778007e22c2e55c4009a49c7 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/64fa9328948ddcc0f7f3c23ea1756c126d9dffac | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/ae25cf2ea9ebd06d7ad416647dbdc7b5d0172946 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/eb3cd9bb590460c6127145cb245be925d23f5232 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.