CVE-2026-64135

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 widen blackbox-info buffer to I2CSMBUSBLOCKMAX adm1266nvmemreadblackbox declares a 5-byte stack buffer and passes it to i2csmbusreadblockdata to retrieve the 4-byte BLACKBOXINFO response. i2csmbusreadblockdat...

CVE-2026-64135

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 widen blackbox-info buffer to I2CSMBUSBLOCKMAX adm1266nvmemreadblackbox declares a 5-byte stack buffer and passes it to i2csmbusreadblockdata to retrieve the 4-byte BLACKBOXINFO response. i2csmbusreadblockdat...

CVE-2026-64135 hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 widen blackbox-info buffer to I2CSMBUSBLOCKMAX adm1266nvmemreadblackbox declares a 5-byte stack buffer and passes it to i2csmbusreadblockdata to retrieve the 4-byte BLACKBOXINFO response. i2csmbusreadblockdat...

CVE-2026-64087

CVE-2026-64087 is an out-of-bounds read in the Linux kernel's adm1266 PMBus hardware-monitoring driver. The function adm1266_nvmem_read_blackbox() uses a record_count value taken directly from byte 3 of a device's BLACKBOX_INFO response as a loop bound without validating it against the maximum of...

EUVD-2026-45772

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject implausible blackbox recordcount adm1266nvmemreadblackbox loops over a recordcount that comes straight from byte 3 of the BLACKBOXINFO response. The destination buffer is data-devmem, sized for the nvm...

CVE-2026-64087 hwmon: (pmbus/adm1266) reject implausible blackbox record_count

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject implausible blackbox recordcount adm1266nvmemreadblackbox loops over a recordcount that comes straight from byte 3 of the BLACKBOXINFO response. The destination buffer is data-devmem, sized for the nvm...

CVE-2026-64085

CVE-2026-64085 is a buffer overflow in the Linux kernel's hwmon (pmbus/adm1266) driver. The helper adm1266_pmbus_block_xfer() trusts the device-supplied length and can write up to 255 bytes , but adm1266_nvmem_read_blackbox() advances in 64-byte strides within a 2048-byte dev_mem buffer. On the t...

CVE-2026-64086

The CVE-2026-64086 issue affects the Linux kernel PMBUS adm1266 hwmon path. A read transaction for the pmbus_block_xfer path set .len to ADM1266_PMBUS_BLOCK_MAX + 2 while read_buf was declared as ADM1266_PMBUS_BLOCK_MAX + 1. For max-length block responses, this allowed writing 257 bytes into a 25...

EUVD-2026-45657

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 cap PDIO scan in getmultiple at ADM1266PDIONR adm1266gpiogetmultiple iterates the PDIO portion of the caller-supplied mask using foreachsetbitfromgpionr, mask, ADM1266GPIONR + ADM1266PDIOSTATUS ... where...

CVE-2026-64084 hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 cap PDIO scan in getmultiple at ADM1266PDIONR adm1266gpiogetmultiple iterates the PDIO portion of the caller-supplied mask using foreachsetbitfromgpionr, mask, ADM1266GPIONR + ADM1266PDIOSTATUS ... where...

CVE-2026-64084

Summary: CVE-2026-64084 affects the Linux kernel’s hwmon pmbus/adm1266 driver. The bug occurs in adm1266_gpio_get_multiple() when iterating the PDIO portion of the caller-supplied mask. It uses for_each_set_bit_from with an upper bound of ADM1266_GPIO_NR + ADM1266_PDIO_STATUS (0xE9/233) instead o...

CVE-2026-64084 hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 cap PDIO scan in getmultiple at ADM1266PDIONR adm1266gpiogetmultiple iterates the PDIO portion of the caller-supplied mask using foreachsetbitfromgpionr, mask, ADM1266GPIONR + ADM1266PDIOSTATUS ... where...

CVE-2026-64083 hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject short block-read responses in the GPIO accessors adm1266gpioget and adm1266gpiogetmultiple both compose the pin-status word as pinsstatus = readbuf0 + readbuf1 8; right after i2csmbusreadblockdata,...

CVE-2026-64038

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

CVE-2026-64038 hwmon: (lm90) Stop work before releasing hwmon device

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

EUVD-2026-45611

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

CVE-2026-64038

CVE-2026-64038 concerns the Linux kernel hwmon lm90 driver. In lm90_probe(), devm actions to cancel alert_work and report_work were registered before hwmon device registration. With devm cleanup in reverse order, the hwmon device could be freed first, allowing lm90_update_alarms() to dereference ...

CVE-2026-63794

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sevdbgcrypt for ENCRYPT path In sevdbgcrypt, the per-iteration transfer length is bounded by the source page offset PAGESIZE - soff but not by the destination page offset PAGESIZE - doff. When doff...

PT-2026-61400

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hwmon module specifically within the pmbus/adm1266 driver. The functions adm1266 gpio get and adm1266 gpio get multiple fail to verify the length of the data...

PT-2026-61355

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the lm90 hardware monitoring driver. The issue occurs because cleanup actions are executed in reverse order during module unbind or probe failure. If the lm90...