Linux kernel adm1266 hwmon: device-supplied block length overflows the blackbox NVMEM buffer by 191 bytes

Impact

adm1266_nvmem_read_blackbox() walks the 2048-byte dev_mem allocation in 64-byte strides, but the block transfer helper it calls will copy however many bytes the chip's length byte claims, up to 255. A device answering with more than 64 bytes on the trailing record writes up to 191 bytes past the allocation, and the driver's length check only runs after the copy. The trust boundary crossed here is hardware-to-host: the attacker is whatever sits on the board's PMBus/I2C segment - the sequencer's own firmware, or anything able to answer in its place - not a tenant. On a power-sequencer-equipped server the realistic outcome is kernel heap corruption and a node that has to be rebooted. Nodes whose boards do not carry an ADM1266, or that do not build CONFIG_SENSORS_ADM1266, have no exposure. This is one of three separate adm1266 fixes in this batch; the mechanisms and fixes differ, so they are listed separately.

Who can reach it

Requires a malicious or malfunctioning ADM1266 on the board's PMBus segment, plus a local read of the blackbox nvmem file - normally root-level access to sysfs on the host. Not reachable over the network and not reachable from a tenant pod without that sysfs path.

What to do

Pick up the fix in a stable kernel (commits linked in the record) and reboot each affected node, draining GPU workloads first. No vendor advisory or standalone fixed version is given beyond the upstream commits. Where the chip is not monitored, not building or not loading the adm1266 module removes the exposure without a kernel update.

References

Related entries

• Linux kernel adm1266 hwmon: PMBus block read buffer one byte short, i2c write and PEC compare overrunCVE-2026-64086 · Linux kernel hwmon pmbus/adm1266 (pmbus_block_xfer read buffer)High
• Linux kernel IOMMU core: unbalanced unmap accounting on the map error path with iommu_debug onCVE-2026-64152 · Linux kernel IOMMU core (iommu_map error path, iommu_debug tracking)High
• Linux kernel perf AUX buffer: missing aux_mutex in map_range lets a local user map a freed pageCVE-2026-64300 · Linux kernel perf ring buffer AUX area (map_range / rb_alloc_aux locking)High
• Linux kernel QAT crypto driver: oversized RSA CRT components overflow half-size DMA buffersCVE-2026-64304 · Linux kernel crypto qat driver (RSA CRT key setup, qat_rsa_setkey_crt)High
• Linux kernel Intel QAT: unlocked service_table walks can corrupt the list or use freed entriesCVE-2026-64305 · Linux kernel Intel QAT driver (adf service_table list locking)High
• Linux kernel BPF TCP iterator: double socket release on batch realloc failure panics the nodeCVE-2026-64575 · Linux kernel BPF TCP iterator (bpf_iter_tcp_batch)High