High 7.8Published Jul 19, 2026

CVE-2026-64084hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR

Updated under an hour ago (Oct 26, 2026, 4:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) { ... } where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR = 25. gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip), so the iteration walks find_next_bit() up to 242, reading up to 217 extra bits (a handful of unsigned-long words: four on 64-bit, seven on 32-bit) of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds. Substitute ADM1266_PDIO_NR for the constant so the scan stops at the last real PDIO bit.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d98dfad35c38c037b37c4adc99df01da571031a5 before d0593e15fdeb56048a72c5c6e720f702759d0ccd; from d98dfad35c38c037b37c4adc99df01da571031a5 before 17cee2f59029039416e8f6303050038eb59ba149; from d98dfad35c38c037b37c4adc99df01da571031a5 before 299efd14c2eda7e5fd40025e54addd4151a01081; from d98dfad35c38c037b37c4adc99df01da571031a5 before 4d1da9a6be5a8156c532d571c2ed237169f99244; from d98dfad35c38c037b37c4adc99df01da571031a5 before b96c7f0bc0713dc6403912f6527d4ff9168d6fe6; from d98dfad35c38c037b37c4adc99df01da571031a5 before fa7ca363069a70b0d1aa51e8892e3095fe2ac1ec; from d98dfad35c38c037b37c4adc99df01da571031a5 before 2aef8f08c479f4cbc83e1e6b19d1c94d4dd24f17; from d98dfad35c38c037b37c4adc99df01da571031a5 before d7834d92251baade796812876e95555e2066fa9f	CNA record
linux linux_kernel linux:linux_kernel	from 5.10 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/d0593e15fdeb56048a72c5c6e720f702759d0ccd	patch
https://git.kernel.org/stable/c/17cee2f59029039416e8f6303050038eb59ba149	patch
https://git.kernel.org/stable/c/299efd14c2eda7e5fd40025e54addd4151a01081	patch
https://git.kernel.org/stable/c/4d1da9a6be5a8156c532d571c2ed237169f99244	patch
https://git.kernel.org/stable/c/b96c7f0bc0713dc6403912f6527d4ff9168d6fe6	patch
https://git.kernel.org/stable/c/fa7ca363069a70b0d1aa51e8892e3095fe2ac1ec	patch
https://git.kernel.org/stable/c/2aef8f08c479f4cbc83e1e6b19d1c94d4dd24f17	patch
https://git.kernel.org/stable/c/d7834d92251baade796812876e95555e2066fa9f	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.