{"id":15064,"date":"2026-09-04T19:02:24","date_gmt":"2026-09-04T11:02:24","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64086"},"modified":"2026-09-04T19:02:24","modified_gmt":"2026-09-04T11:02:24","slug":"cve-2026-64086","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64086","title":{"rendered":"CVE-2026-64086 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus\/adm1266"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>hwmon: (pmbus\/adm1266) include PEC byte in pmbus_block_xfer read buffer<\/p>\n<p>adm1266_pmbus_block_xfer() sets up the read transaction with<\/p>\n<p>\t.buf = data-&gt;read_buf,<br \/>\n\t.len = ADM1266_PMBUS_BLOCK_MAX + 2,<\/p>\n<p>but read_buf in struct adm1266_data is declared as<\/p>\n<p>\tu8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1];<\/p>\n<p>For a max-length block response (length byte = 255 + up to 1 PEC<br \/>\nbyte), the i2c controller is told to write 257 bytes into a 256-byte<br \/>\nbuffer, putting one byte past the end of read_buf.  The same response<br \/>\nalso makes the subsequent PEC compare<\/p>\n<p>\tif (crc != msgs[1].buf[msgs[1].buf[0] + 1])<\/p>\n<p>read a byte beyond the array.<\/p>\n<p>Bump the read_buf declaration to ADM1266_PMBUS_BLOCK_MAX + 2 so the<br \/>\nbuffer can hold the length byte, up to 255 payload bytes, and the PEC<br \/>\nbyte the i2c_msg length already accounts for.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>hwmon: (pmbus\/adm1266) include PEC byte in pmbus_block_xfer read buffer<\/p>\n<p>adm1266_pmbus_block_xfer() sets up the read transaction wi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15064","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}