CVE-2026-64084 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using
for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) {
... }
where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR = 25.
gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip), so the iteration walks find_next_bit() up to 242, reading up to 217 extra bits (a handful of unsigned-long words: four on 64-bit, seven on 32-bit) of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds.
Substitute ADM1266_PDIO_NR for the constant so the scan stops at the last real PDIO bit.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability exists within the Linux kernel's hardware monitoring subsystem, specifically in the pmbus/adm1266 driver implementation. This issue manifests as an incorrect boundary calculation during GPIO pin enumeration, where the driver mistakenly uses a PMBus command code value instead of the actual number of PDIO pins for loop iteration limits. The flaw occurs in the adm1266_gpio_get_multiple() function which processes GPIO masks for hardware monitoring operations. The problematic constant ADM1266_PDIO_STATUS with value 0xE9 (233 decimal) is used as an upper boundary parameter in a for_each_set_bit_from loop, when it should represent the actual number of PDIO pins rather than a command code.
The technical execution of this vulnerability involves the gpiolib subsystem processing caller-supplied mask data that contains 25 bits representing the total GPIO configuration. However, due to the incorrect constant usage, the iteration extends far beyond valid pin boundaries, reaching up to 242 iterations instead of the intended 25. This causes find_next_bit() to scan memory locations well beyond the allocated mask buffer, potentially reading and writing data from adjacent stack memory regions. The consequence is that any bits set in the unintended memory locations trigger additional bit manipulation operations that write past the bounds of the caller-supplied bits array, creating both read and write out-of-bounds memory access conditions.
This vulnerability represents a classic buffer overflow scenario with undefined behavior characteristics, where the system may encounter memory corruption during hardware monitoring operations. The impact extends beyond simple data corruption as it could potentially allow privilege escalation or system instability when maliciously crafted GPIO masks are processed through the affected driver. According to CWE classification, this maps to CWE-129: Improper Validation of Array Index and CWE-787: Out-of-bounds Write, both of which are critical security concerns in kernel space operations. From an ATT&CK perspective, this vulnerability could be leveraged for privilege escalation through kernel memory corruption techniques, potentially enabling lateral movement or persistent access within affected systems.
The mitigation strategy requires a straightforward code correction where the constant ADM1266_PDIO_NR is substituted for the erroneous ADM1266_PDIO_STATUS value in the loop boundary calculation. This change ensures that the iteration properly bounds at the last valid PDIO pin rather than extending into invalid memory regions. The fix aligns with secure coding practices by ensuring proper validation of array indices and boundary conditions within kernel drivers. System administrators should prioritize applying this patch to all affected Linux kernel versions, particularly those running hardware monitoring configurations that utilize the ADM1266 power management device driver. The resolution directly addresses the root cause without introducing functional changes or performance impacts to legitimate operations.