Look up another CVE · open CVE-2026-64086 in the interactive tracker
CVE-2026-64086
hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem drivers/hwmon. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-64086 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.176-1 | Update the kernel and reboot. Fixed in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
adm1266_pmbus_block_xfer() sets up the read transaction with .buf = data->read_buf, .len = ADM1266_PMBUS_BLOCK_MAX + 2, but read_buf in struct adm1266_data is declared as u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1]; For a max-length block response (length byte = 255 + up to 1 PEC byte), the i2c controller is told to write 257 bytes into a 256-byte buffer, putting one byte past the end of read_buf. The same response also makes the subsequent PEC compare if (crc != msgs[1].buf[msgs[1].buf[0] + 1]) read a byte beyond the array. Bump the read_buf declaration to ADM1266_PMBUS_BLOCK_MAX + 2 so the buffer can hold the length byte, up to 255 payload bytes, and the PEC byte the i2c_msg length already accounts for.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/hwmon/pmbus/adm1266.c
- What this is
- HARDWARE MONITORINGMAINTAINERS section matched on drivers/hwmon/ · linux-hwmon@vger.kernel.org · Maintained
- Kernel module
- none to look for. The file would have gone into adm1266, and Debian does not compile it into that module, so finding adm1266 in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_HWMON|CONFIG_PMBUS|CONFIG_SENSORS_ADM1266' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_HWMON, CONFIG_PMBUS, CONFIG_SENSORS_ADM1266
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 2.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/hwmon
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.10 | 5.10.258 | 397d3f523bff |
| 5.10 | 5.15.209 | 472744f69d25 |
| 5.10 | 6.1.175 | 528a9f88e885 |
| 5.10 | 6.6.142 | d94ceb16e55b |
| 5.10 | 6.12.92 | bd5be3fa5de6 |
| 5.10 | 6.18.34 | 2279c342d94e |
| 5.10 | 7.0.11 | a6c802145a8d |
| 5.10 | 7.1 | 487566cb1ccd |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable code is only reached through local kernel interfaces (debugfs GPIO dump at /sys/kernel/debug/gpio and root-only nvmem blackbox reads), not through any network protocol handler. The ADM1266 sits on an on-board I2C bus on server BMC hardware.
- AC:LAttack complexity, low
- An attacker who controls the I2C bus response (malicious device, compromised ADM1266 firmware, or bus interposition on the BMC) can reliably force a 255-byte block reply whenever a victim triggers the block-transfer path, causing the one-byte overflow on demand.
- PR:LPrivileges required, low
- The gpio debugfs entry is world-readable (0444) if debugfs is mounted and traversable, which occurs on some embedded BMC images without strict permissions; between requiring full init-namespace root and that lower bar, the less privileged path is plausible on misconfigured systems.
- UI:NUser interaction, none
- Exploitation does not require victim interaction beyond the attacker (or a compromised daemon) programmatically reading debugfs or nvmem; no mount, click, or plug-in action by an end user is needed.
- S:UScope, unchanged
- Impact is confined to kernel memory corruption within the BMC/host kernel security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.
- C:HConfidentiality impact, high
- The PEC validation performs an out-of-bounds read past read_buf, and the one-byte heap overflow can corrupt adjacent kernel objects in ways that enable further memory disclosure primitives.
- I:HIntegrity impact, high
- A one-byte, attacker-controlled out-of-bounds write past the end of read_buf into adjacent heap memory can corrupt slab metadata or neighboring objects and be developed into arbitrary write or code-execution primitives.
- A:HAvailability impact, high
- Corrupting adjacent heap objects via the out-of-bounds write can cause kernel oops, panic, or hang on the BMC, denying management-plane availability for the managed server.