Skip to main content

Linux Kernel CVE-2026-64087

| EUVDEUVD-2026-45772 MEDIUM
2026-07-19 Linux GHSA-p924-4557-4g43
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access and a loaded driver required; no confidentiality or integrity impact confirmed; A:H reflects kernel crash from heap overrun on out-of-bounds loop.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.2 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 03, 2026 - 16:40 vuln.today
tag: Information Disclosure replaced by Denial Of Service
Analysis Generated
Sep 03, 2026 - 16:28 vuln.today
CVSS changed
Sep 03, 2026 - 16:22 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:39 nvd
MEDIUM 5.5
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) reject implausible blackbox record_count

adm1266_nvmem_read_blackbox() loops over a record_count that comes straight from byte 3 of the BLACKBOX_INFO response. The destination buffer is data->dev_mem, sized for the nvmem cell's declared 2048 bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE = 32 * 64). A device that reports a record_count greater than 32 -- whether due to firmware bugs, bus corruption, or a non-responsive slave returning 0xff -- would walk read_buff past the end of the dev_mem allocation on the trailing iterations.

Cap record_count at ADM1266_BLACKBOX_MAX_RECORDS (introduced here) before entering the loop and return -EIO on any larger value, so a malformed BLACKBOX_INFO response cannot drive the loop out of bounds.

AnalysisAI

Heap buffer overflow in the Linux kernel's hwmon adm1266 PMBus driver allows a local attacker or a malicious/buggy PMBus device to crash the kernel by inducing a record_count value exceeding 32 in a BLACKBOX_INFO response, overrunning the fixed 2048-byte dev_mem allocation in adm1266_nvmem_read_blackbox(). Systems with the adm1266 driver loaded against ADM1266 hardware are affected across multiple stable kernel branches; patched versions are confirmed across Linux 5.10.258 through 7.0.11. EPSS at 0.18% and absence of KEV listing indicate no active exploitation at time of analysis.

Technical ContextAI

The ADM1266 is an Analog Devices multi-sequencer PMBus power controller deployed in server and data center platforms. Its Linux driver (drivers/hwmon/pmbus/adm1266.c) exposes an nvmem interface for reading blackbox event records. The function adm1266_nvmem_read_blackbox() reads record_count from byte 3 of the BLACKBOX_INFO PMBus command response and iterates unconditionally, appending 64-byte records into data->dev_mem - a statically allocated buffer of ADM1266_BLACKBOX_MAX_RECORDS × ADM1266_BLACKBOX_SIZE = 32 × 64 = 2048 bytes. A device returning record_count > 32 (e.g., 0xFF from a non-responsive bus slave or firmware defect) drives subsequent writes beyond the heap allocation boundary, constituting a classic heap buffer overflow (CWE not assigned; equivalent to CWE-119/CWE-120). The fix caps record_count at ADM1266_BLACKBOX_MAX_RECORDS before entering the loop and returns -EIO for any larger value, preventing the out-of-bounds traversal. CPE cpe:2.3:a:linux:linux identifies the Linux kernel as the affected software component.

RemediationAI

Apply the vendor-released kernel patches corresponding to the running stable branch: 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, or 7.0.11, as published at git.kernel.org and confirmed in EUVD-2026-45772. Ubuntu users should follow USN-8575-1 at https://ubuntu.com/security/notices/USN-8575-1. If immediate patching is infeasible, blacklisting the adm1266 kernel module by adding 'blacklist adm1266' to /etc/modprobe.d/ and rebooting prevents the vulnerable code path from executing; the trade-off is loss of PMBus hardware monitoring for any attached ADM1266 power sequencers. Restricting access to the nvmem sysfs interface via udev rules or filesystem permissions limits the local user exploitation vector but does not protect against a misbehaving physical device autonomously triggering the read path via kernel threads.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

CVE-2026-64087 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy