CVE-2026-64085

What it actually does

This is a Linux kernel buffer overflow in the ADM1266 PMBus hardware-monitoring driver. When reading ADM1266 blackbox records, the driver passes a pointer into a 2,048-byte allocation to a helper that may copy up to 255 bytes from the device, while each destination slot is only 64 bytes. A malicious, compromised, or malfunctioning ADM1266-compatible PMBus device can return an oversized block length, causing the kernel to write past the end of the allocated buffer by up to 191 bytes. The likely outcomes are kernel memory corruption, denial of service through a crash or panic, and, in a worst case, potential kernel-mode code execution depending on memory layout and exploit reliability.

Why it matters to the business

Systems that load the affected ADM1266 PMBus driver and communicate with ADM1266-compatible power-management hardware may be exposed to instability or compromise triggered by device-supplied data. The practical exposure is narrower than typical network vulnerabilities because exploitation requires control over, or compromise of, the attached PMBus device, its firmware, the hardware supply chain, or a privileged path that can emulate or manipulate device responses. For organizations using affected hardware in servers, appliances, embedded platforms, industrial systems, or lab environments, the main operational risks are unexpected kernel crashes, service interruption, and reduced trust in platform hardware telemetry. EPSS is currently low and the issue is not listed in CISA KEV, so broad exploitation is not indicated, but kernel memory corruption in hardware-facing drivers should still be prioritized where the ADM1266 driver is present.

How an attack unfolds

An attacker first needs a way to influence the ADM1266 PMBus device responses seen by the Linux kernel, such as compromised device firmware, malicious replacement hardware, a hostile emulated PMBus device, or privileged access to a bus-testing environment. The attacker then waits for or triggers a read of the ADM1266 blackbox NVMEM data. During the final record reads, the vulnerable driver supplies a pointer near the end of its 2,048-byte buffer while the PMBus helper trusts the device-reported block length. The malicious device returns more than the expected 64 bytes, up to the PMBus block maximum of 255 bytes. The helper copies that oversized response into the caller’s buffer before the caller validates the length, corrupting adjacent kernel memory. Depending on surrounding heap state and kernel hardening, this may immediately crash the system, produce sanitizer or oops logs, corrupt driver state, or potentially be shaped into more serious kernel compromise. There is no indication of public exploit maturity or known in-the-wild exploitation at this time.

How to fix it

Apply a Linux kernel update that includes the ADM1266 PMBus driver fix, which reads records into a protocol-sized bounce buffer, validates the returned length, and only then copies the expected 64 bytes into the destination buffer. If a fixed kernel is not yet available from the operating-system or appliance vendor, reduce exposure by disabling or blacklisting the adm1266 driver where it is not required, preventing automatic loading of unnecessary hwmon/PMBus drivers, and restricting physical, firmware, and administrative access to I2C/PMBus-capable hardware. Treat ADM1266 firmware and hardware provenance as part of the mitigation: update device firmware where applicable, avoid untrusted replacement components, and ensure hardware-management buses are not exposed to untrusted users or test fixtures. Because no affected product list or fixed version list was provided, use vendor kernel advisories, distribution changelogs, and the upstream kernel commit history for the authoritative fixed package version.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel package includes the ADM1266 PMBus fix for oversized blackbox block reads. Review distribution or vendor changelogs for the ADM1266 PMBus blackbox bounce-buffer patch. On systems where ADM1266 hardware is not required, confirm the driver is not loaded using module inventory and kernel configuration checks. Where the driver must remain enabled, validate in a controlled lab that ADM1266 blackbox/NVMEM reads complete without kernel warnings, KASAN reports, oops messages, or crashes. Do not attempt to reproduce oversized PMBus responses on production systems because successful triggering can corrupt kernel memory or crash the host.

Typical attack path

1. Identify a Linux system using the ADM1266 PMBus hardware-monitoring driver.
2. Gain control over the ADM1266-compatible PMBus device, its firmware, a bus emulator, or another mechanism capable of influencing PMBus block-read responses.
3. Trigger or wait for the kernel to read ADM1266 blackbox NVMEM records.
4. Return a PMBus block response larger than the expected 64-byte blackbox record size, especially when the destination pointer is near the end of the 2,048-byte allocation.
5. Cause the driver helper to copy the oversized device-supplied payload into an undersized kernel buffer slot.
6. Leverage the resulting kernel memory corruption to crash the system, disrupt services, or attempt further privilege escalation depending on exploitability.

How to detect it

Look for evidence of exploitation or triggering in kernel logs, persistent journal logs, crash dumps, pstore records, kdump/vmcore artifacts, and hardware-management telemetry around ADM1266, PMBus, hwmon, or NVMEM blackbox activity. Relevant signs include kernel oopses, panics, KASAN or slab out-of-bounds reports, general protection faults, use-after-corruption symptoms, unexpected reboots, or driver errors occurring during ADM1266 blackbox reads. Because exploitation requires malicious or abnormal device responses, also review firmware-update logs, BMC or service-processor audit logs, physical maintenance records, lab bus-emulation activity, and any I2C/PMBus diagnostic tool usage. Absence of logs does not prove absence of exposure, especially if kernel crash logging is not persistent. There are no known public threat actors or campaigns associated with this issue in the supplied intelligence.

• adm1266
• pmbus
• PMBus
• hwmon
• nvmem
• blackbox
• adm1266_nvmem_read_blackbox
• adm1266_pmbus_block_xfer
• KASAN: slab-out-of-bounds
• KASAN: out-of-bounds
• BUG: KASAN
• kernel BUG
• kernel panic
• Oops:
• general protection fault
• BUG: unable to handle kernel paging request
• slab-out-of-bounds
• hwmon: (pmbus/adm1266)

What your security team should do

• Inventory Linux systems, appliances, and embedded platforms for ADM1266 PMBus hardware and the adm1266 kernel driver.
• Prioritize patching systems where the adm1266 driver is loaded or built into the kernel and where PMBus hardware is present.
• If patching is delayed, disable or blacklist the adm1266 driver on systems that do not require ADM1266 telemetry or blackbox access.
• Restrict access to hardware-management buses, firmware update mechanisms, BMC/service interfaces, lab fixtures, and any tooling capable of emulating or manipulating PMBus devices.
• Review recent kernel logs for crashes, KASAN reports, oopses, or anomalies involving adm1266, PMBus, hwmon, or nvmem blackbox reads.
• Coordinate with hardware, platform, and firmware teams to verify ADM1266 component provenance and firmware integrity.
• Monitor vendor advisories for exact fixed kernel package versions because no fixed versions were supplied in the vulnerability metadata.