Linux kernel adm1266 hwmon: PDIO scan bound confused with PMBus command code, out-of-bounds read and write

Impact

adm1266_gpio_get_multiple() bounds its PDIO bit scan with ADM1266_PDIO_STATUS, the PMBus command code 0xE9, instead of ADM1266_PDIO_NR, the pin count. gpiolib hands in a 25-bit mask, so the loop walks to bit 242 - reading several unsigned longs past the end of the caller's on-stack mask, and for any incidental set bit found there, writing past the end of the caller's results array too. Both sides of the overrun are in kernel stack memory belonging to the caller, which makes it a plausible local escalation primitive as well as a crash. Unlike the other two adm1266 issues in this batch, this one needs no cooperation from the device at all - it fires on an ordinary GPIO read. Exposure is limited to hosts whose boards carry the ADM1266 with the driver loaded.

Who can reach it

Local user able to reach the gpiochip character device or hwmon interface that exposes the ADM1266 lines - in practice root, or a member of the group owning /dev/gpiochipN. Not reachable over the network, and not from a container that has not been given the gpiochip device.

What to do

Pick up the fix in a stable kernel (commits linked in the record) and reboot each affected node, draining GPU workloads first. No vendor advisory or standalone fixed version is given beyond the upstream commits. Where the sequencer is not monitored from the host, not loading the adm1266 module closes it without a kernel update; otherwise restrict access to the gpiochip device until the node is rebooted.

References

Related entries

• Linux kernel adm1266 hwmon: device-supplied block length overflows the blackbox NVMEM buffer by 191 bytesCVE-2026-64085 · Linux kernel hwmon pmbus/adm1266 (blackbox NVMEM record read)High
• Linux kernel adm1266 hwmon: PMBus block read buffer one byte short, i2c write and PEC compare overrunCVE-2026-64086 · Linux kernel hwmon pmbus/adm1266 (pmbus_block_xfer read buffer)High
• Linux kernel IOMMU core: unbalanced unmap accounting on the map error path with iommu_debug onCVE-2026-64152 · Linux kernel IOMMU core (iommu_map error path, iommu_debug tracking)High
• Linux kernel perf AUX buffer: missing aux_mutex in map_range lets a local user map a freed pageCVE-2026-64300 · Linux kernel perf ring buffer AUX area (map_range / rb_alloc_aux locking)High
• Linux kernel QAT crypto driver: oversized RSA CRT components overflow half-size DMA buffersCVE-2026-64304 · Linux kernel crypto qat driver (RSA CRT key setup, qat_rsa_setkey_crt)High
• Linux kernel Intel QAT: unlocked service_table walks can corrupt the list or use freed entriesCVE-2026-64305 · Linux kernel Intel QAT driver (adf service_table list locking)High