CVE-2026-64083: hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-19 · updated 2026-09-03

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors adm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the pin-status word as pins_status = read_buf[0] + (read_buf[1] << 8); right after i2c_smbus_read_block_data(), guarding only against an error return. A well-behaved device returns 2 bytes for GPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or 1-byte response too. If the device returns 0 bytes, both read_buf slots are uninitialized stack memory; if it returns 1 byte, read_buf[1] is. The composed value then flows through set_bit() into the caller's *bits in adm1266_gpio_get_multiple(), or into the return value of adm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and the char-dev ioctls). That leaks a few bits of kernel stack per request on any device whose firmware glitch, bus error, or hostile slave produces a short block-read response. Add the missing length check to both call sites and surface a short response as -EIO.

Affected products

Linux kernel: from 5.10 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34 — fixed in 5.10.258, 5.15.209, 6.1.175, 6.12.92, 6.18.34, 6.6.142

How to fix

Upgrade to a fixed version: Linux kernel 5.10.258, 5.15.209, 6.1.175, 6.12.92. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-64083 or the next vulnerability affects your stack