Linux Kernel HWMon adm1266 PDIO Get_Multiple OOB Mem Access
CVE-2026-64084 Published on July 19, 2026
hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
adm1266_gpio_get_multiple() iterates the PDIO portion of the
caller-supplied mask using
for_each_set_bit_from(gpio_nr, mask,
ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) {
...
}
where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233),
not the number of PDIO pins. The intended upper bound is
ADM1266_GPIO_NR + ADM1266_PDIO_NR = 25.
gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip),
so the iteration walks find_next_bit() up to 242, reading up to 217
extra bits (a handful of unsigned-long words: four on 64-bit, seven
on 32-bit) of whatever lives past the end of the mask in the
caller's stack. Any incidental set bit in that range then drives a
set_bit(gpio_nr, bits) call that writes past the end of the
caller-supplied bits array too -- both out-of-bounds.
Substitute ADM1266_PDIO_NR for the constant so the scan stops at the
last real PDIO bit.
Products Associated with CVE-2026-64084
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version d98dfad35c38c037b37c4adc99df01da571031a5 and below d0593e15fdeb56048a72c5c6e720f702759d0ccd is affected.
- Version d98dfad35c38c037b37c4adc99df01da571031a5 and below 17cee2f59029039416e8f6303050038eb59ba149 is affected.
- Version d98dfad35c38c037b37c4adc99df01da571031a5 and below 299efd14c2eda7e5fd40025e54addd4151a01081 is affected.
- Version d98dfad35c38c037b37c4adc99df01da571031a5 and below 4d1da9a6be5a8156c532d571c2ed237169f99244 is affected.
- Version d98dfad35c38c037b37c4adc99df01da571031a5 and below b96c7f0bc0713dc6403912f6527d4ff9168d6fe6 is affected.
- Version d98dfad35c38c037b37c4adc99df01da571031a5 and below fa7ca363069a70b0d1aa51e8892e3095fe2ac1ec is affected.
- Version d98dfad35c38c037b37c4adc99df01da571031a5 and below 2aef8f08c479f4cbc83e1e6b19d1c94d4dd24f17 is affected.
- Version d98dfad35c38c037b37c4adc99df01da571031a5 and below d7834d92251baade796812876e95555e2066fa9f is affected.
- Version 5.10 is affected.
- Before 5.10 is unaffected.
- Version 5.10.258, <= 5.10.* is unaffected.
- Version 5.15.209, <= 5.15.* is unaffected.
- Version 6.1.175, <= 6.1.* is unaffected.
- Version 6.6.142, <= 6.6.* is unaffected.
- Version 6.12.92, <= 6.12.* is unaffected.
- Version 6.18.34, <= 6.18.* is unaffected.
- Version 7.0.11, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.