CVE-2026-64083 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
adm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the pin-status word as
pins_status = read_buf[0] + (read_buf[1] << 8);
right after i2c_smbus_read_block_data(), guarding only against an error return. A well-behaved device returns 2 bytes for GPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or 1-byte response too. If the device returns 0 bytes, both read_buf slots are uninitialized stack memory; if it returns 1 byte, read_buf[1]
is.
The composed value then flows through set_bit() into the caller's *bits in adm1266_gpio_get_multiple(), or into the return value of adm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and the char-dev ioctls). That leaks a few bits of kernel stack per request on any device whose firmware glitch, bus error, or hostile slave produces a short block-read response.
Add the missing length check to both call sites and surface a short response as -EIO.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides in the linux kernel's hardware monitoring subsystem specifically within the pmbus driver for the adm1266 device. This flaw occurs in the gpio accessor functions adm1266_gpio_get() and adm1266_gpio_get_multiple() which process pin-status word data from i2c_smbus_read_block_data() calls without proper validation of the received data length. The technical implementation error stems from a direct byte composition operation where pins_status = read_buf[0] + (read_buf[1] << 8) is performed immediately after reading block data, bypassing any verification that both bytes were actually received.
The core issue manifests when devices return incomplete responses during i2c communication, particularly zero or one byte responses instead of the expected two-byte GPIO_STATUS/PDIO_STATUS data. When a device returns zero bytes, both read_buf[0] and read_buf[1] contain uninitialized stack memory values, while a single byte response leaves read_buf[1] uninitialized. This uninitialized memory contamination propagates through the set_bit() operations into the caller's output parameters or return values, ultimately leaking kernel stack memory contents to userspace via gpiolib interfaces including sysfs and character device ioctls.
This vulnerability represents a classic information disclosure flaw that aligns with CWE-248 Uncontrolled Format String and falls under ATT&CK technique T1005 Data from Local System. The operational impact extends beyond simple information leakage as the leaked stack bits could potentially contain sensitive kernel memory patterns, session tokens, or other confidential data that might aid in further exploitation attempts. The vulnerability affects systems utilizing the adm1266 hardware monitoring device through the pmbus interface and demonstrates poor input validation practices in kernel space communication handling.
Mitigation requires implementing proper length validation at both call sites where i2c_smbus_read_block_data() is invoked, specifically checking that exactly two bytes are returned before proceeding with the byte composition. The solution should surface short responses as -EIO error codes rather than silently processing incomplete data, thereby preventing the leakage of uninitialized stack memory. This fix aligns with security best practices for kernel driver development and follows established protocols for handling i2c communication errors in embedded systems. The implementation must ensure that all block read operations validate their return lengths against expected values before any data processing occurs, maintaining the principle of least privilege and preventing unauthorized information disclosure through memory leakage channels.