What is the CVSS score of CVE-2026-64086?

CVE-2026-64086 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64086?

A vulnerability in the Linux kernel's power-monitoring driver (CVE-2026-64086) could enable kernel-level compromise if a malicious device is placed on an I2C bus.. A patch is available.

How to fix or mitigate CVE-2026-64086?

Within 24 hours, identify all systems running the hwmon pmbus/adm1266 driver and assess which expose external or untrusted devices on the I2C bus. Within 7 days, obtain and test kernel patches available from Linux stable kernel branches and plan a deployment window aligned with your change management process. Within 30 days, deploy patched kernel versions to all affected systems, prioritizing those with untrusted I2C device exposure.

Linux Kernel CVE-2026-64086

EUVD-2026-45659 HIGH

2026-07-19 Linux

GHSA-f42m-8rh7-xp4f

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.8 MEDIUM

Local hardware path (AV:L) needing a controlled max-length device response (AC:H); one-byte OOB write/read yields limited C/I impact but plausible kernel crash (A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:20 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:39 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer

adm1266_pmbus_block_xfer() sets up the read transaction with

.buf = data->read_buf, .len = ADM1266_PMBUS_BLOCK_MAX + 2,

but read_buf in struct adm1266_data is declared as

u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1];

For a max-length block response (length byte = 255 + up to 1 PEC byte), the i2c controller is told to write 257 bytes into a 256-byte buffer, putting one byte past the end of read_buf. The same response also makes the subsequent PEC compare

if (crc != msgs[1].buf[msgs[1].buf[0] + 1])

read a byte beyond the array.

Bump the read_buf declaration to ADM1266_PMBUS_BLOCK_MAX + 2 so the buffer can hold the length byte, up to 255 payload bytes, and the PEC byte the i2c_msg length already accounts for.

AnalysisAI

Out-of-bounds memory access in the Linux kernel's hwmon pmbus/adm1266 driver lets a malicious or malfunctioning ADM1266 PMBus device on the I2C bus trigger a one-byte write past the end of the driver's fixed read_buf array, plus a corresponding out-of-bounds read during the PEC comparison. The read_buf field is sized ADM1266_PMBUS_BLOCK_MAX+1 (256 bytes) while the i2c transaction is programmed for ADM1266_PMBUS_BLOCK_MAX+2 (257 bytes), so a maximum-length block response (255 payload bytes plus a PEC byte) overruns the buffer. No public exploit identified at time of analysis and EPSS risk is low (0.18%, 8th percentile); the flaw is fixed across multiple stable trees.

Technical ContextAI

The affected code is the ADM1266 driver (drivers/hwmon/pmbus/adm1266.c), supporting Analog Devices ADM1266 cascadable power-supply sequencers/supervisors that communicate over PMBus (SMBus/I2C). PMBus block reads return a leading length byte followed by up to 255 data bytes, optionally followed by a Packet Error Checking (PEC) CRC byte. In adm1266_pmbus_block_xfer() the i2c_msg is set with .len = ADM1266_PMBUS_BLOCK_MAX + 2 to accommodate length + payload + PEC, but struct adm1266_data declares read_buf[ADM1266_PMBUS_BLOCK_MAX + 1], leaving no room for the PEC byte. This is a classic fixed-buffer sizing mismatch: an out-of-bounds write (CWE-787) when the i2c controller stores 257 bytes into a 256-byte buffer, and an out-of-bounds read (CWE-125) in the subsequent 'crc != msgs[1].buf[msgs[1].buf[0] + 1]' PEC check when buf[0] is 255. CWE was listed as N/A in the source feed but the description maps cleanly to CWE-787/CWE-125.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1 (or later) - which enlarges read_buf to ADM1266_PMBUS_BLOCK_MAX+2 so the buffer holds the length byte, up to 255 payload bytes, and the PEC byte. The upstream fix commits are available at https://git.kernel.org/stable/c/2279c342d94eca225bf9f301c8806a05a1c81619 and the parallel backports (397d3f52, 472744f6, 528a9f88, d94ceb16, bd5be3fa, a6c80214, 487566cb) under git.kernel.org/stable. Where kernels cannot be updated immediately, the practical compensating control is to unload or blacklist the adm1266 module on systems that do not require it (side effect: loss of ADM1266 power-sequencer monitoring/telemetry), and to physically protect the I2C/PMBus bus so untrusted or attacker-controlled peripherals cannot be attached (side effect: operational restriction on hardware servicing). No firewall/port change applies because this is a local hardware-path issue.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64086 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64086

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code