Linux kernel adm1266 hwmon: PMBus block read buffer one byte short, i2c write and PEC compare overrun

Impact

adm1266_pmbus_block_xfer() tells the i2c controller it may write ADM1266_PMBUS_BLOCK_MAX + 2 bytes into read_buf, which is declared one byte smaller. A maximum-length block response with a PEC byte therefore puts one byte past the end of the buffer inside struct adm1266_data, and the following PEC comparison reads one byte past it as well. Same hardware-to-host boundary as the other adm1266 fixes in this batch, and a much smaller corruption - a single adjacent byte in a driver structure - but it is still an out-of-bounds kernel write driven by the device's answer. Only relevant on boards carrying the ADM1266 with the driver built and loaded. Distinct code path and distinct fix from CVE-2026-64084 and CVE-2026-64085, so it is listed on its own.

Who can reach it

Requires a malicious or malfunctioning ADM1266 on the board's PMBus segment returning a maximum-length block response, together with a local operation that triggers a block read - root-level sysfs/nvmem access on the host. No network path, no tenant path.

What to do

Pick up the fix in a stable kernel (commits linked in the record) and reboot each affected node, draining GPU workloads first. The record names no vendor advisory or fixed release beyond the upstream commits. Not building or not loading the adm1266 module removes the exposure where the chip is not monitored.

References

Related entries

• Linux kernel IOMMU core: unbalanced unmap accounting on the map error path with iommu_debug onCVE-2026-64152 · Linux kernel IOMMU core (iommu_map error path, iommu_debug tracking)High
• Linux kernel perf AUX buffer: missing aux_mutex in map_range lets a local user map a freed pageCVE-2026-64300 · Linux kernel perf ring buffer AUX area (map_range / rb_alloc_aux locking)High
• Linux kernel QAT crypto driver: oversized RSA CRT components overflow half-size DMA buffersCVE-2026-64304 · Linux kernel crypto qat driver (RSA CRT key setup, qat_rsa_setkey_crt)High
• Linux kernel Intel QAT: unlocked service_table walks can corrupt the list or use freed entriesCVE-2026-64305 · Linux kernel Intel QAT driver (adf service_table list locking)High
• Linux kernel BPF TCP iterator: double socket release on batch realloc failure panics the nodeCVE-2026-64575 · Linux kernel BPF TCP iterator (bpf_iter_tcp_batch)High
• Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically whileCVE-2026-64581 · Linux kernel (net/xfrm)High