Medium 5.5Published Jul 19, 2026

CVE-2026-64087hwmon: (pmbus/adm1266) reject implausible blackbox record_count

Updated under an hour ago (Oct 26, 2026, 10:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) reject implausible blackbox record_count adm1266_nvmem_read_blackbox() loops over a record_count that comes straight from byte 3 of the BLACKBOX_INFO response. The destination buffer is data->dev_mem, sized for the nvmem cell's declared 2048 bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE = 32 * 64). A device that reports a record_count greater than 32 -- whether due to firmware bugs, bus corruption, or a non-responsive slave returning 0xff -- would walk read_buff past the end of the dev_mem allocation on the trailing iterations. Cap record_count at ADM1266_BLACKBOX_MAX_RECORDS (introduced here) before entering the loop and return -EIO on any larger value, so a malformed BLACKBOX_INFO response cannot drive the loop out of bounds.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jul 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 15609d1893020436e1e8ccfd9ded774a96dd17a2 before adcb163ad7cacca317872fc62bd8885e842e45e3; from 15609d1893020436e1e8ccfd9ded774a96dd17a2 before c2c56092710fe8a893b67b5a3d7e62808d02d84d; 15609d1893020436e1e8ccfd9ded774a96dd17a2 builds before 5469e1e7c411acc15fdd8262c99c3ebd9defd594; from 15609d1893020436e1e8ccfd9ded774a96dd17a2 before f85c81e93dbd6915970bd5f3bffcf62633c4c54c; 15609d1893020436e1e8ccfd9ded774a96dd17a2 builds before 0e791cd0140fb136083565aadfbe0f705aa260d0; 15609d1893020436e1e8ccfd9ded774a96dd17a2 builds before 75c862adf3d3caab4f49bb3530723c215376e37c; 15609d1893020436e1e8ccfd9ded774a96dd17a2 builds before 231db52a5b64d0a9769e298dadc148e1f79b26a6; 15609d1893020436e1e8ccfd9ded774a96dd17a2 builds before 4afca954622d672ea65ed961bed01cf91caa034e	CNA record
linux linux_kernel linux:linux_kernel	from 5.10 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/adcb163ad7cacca317872fc62bd8885e842e45e3	patch
https://git.kernel.org/stable/c/c2c56092710fe8a893b67b5a3d7e62808d02d84d	patch
https://git.kernel.org/stable/c/5469e1e7c411acc15fdd8262c99c3ebd9defd594	patch
https://git.kernel.org/stable/c/f85c81e93dbd6915970bd5f3bffcf62633c4c54c	patch
https://git.kernel.org/stable/c/0e791cd0140fb136083565aadfbe0f705aa260d0	patch
https://git.kernel.org/stable/c/75c862adf3d3caab4f49bb3530723c215376e37c	patch
https://git.kernel.org/stable/c/231db52a5b64d0a9769e298dadc148e1f79b26a6	patch
https://git.kernel.org/stable/c/4afca954622d672ea65ed961bed01cf91caa034e	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.