Linux Kernel CVE-2026-64135

The ADM1266 is an Analog Devices PMBus power sequencer and supervisor IC deployed in server and embedded hardware, communicating over the I2C/SMBus protocol. In the Linux kernel hwmon pmbus subsystem, adm1266_nvmem_read_blackbox() reads BLACKBOX_INFO data by calling i2c_smbus_read_block_data() with a caller-allocated 5-byte stack buffer. The helper internally uses a union i2c_smbus_data staging buffer, then executes memcpy(values, &data.block[1], data.block[0]) where data.block[0] is the device-reported length byte - up to I2C_SMBUS_BLOCK_MAX = 32 - with no regard for the caller's buffer capacity. The post-call check (if ret != 4 return -EIO) executes after the memcpy has already overwritten up to 27 bytes past the end of the 5-byte stack buffer. The NVD-assigned CWE-674 (Uncontrolled Recursion) appears to be a tagging error; the actual root cause class is CWE-121 (Stack-based Buffer Overflow) or CWE-787 (Out-of-bounds Write). The fix widens the stack buffer to I2C_SMBUS_BLOCK_MAX, consistent with other i2c_smbus_read_block_data callers in the same driver.