CVE-2026-64086

CVE CVE-2026-64086EUVD EUVD-2026-45659Published 2026-07-19T15:39:56.000ZLast changed 2026-08-05T12:39:03.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer adm1266_pmbus_block_xfer() sets up the read transaction with .buf = data->read_buf, .len = ADM1266_PMBUS_BLOCK_MAX + 2, but read_buf in struct adm1266_data is declared as u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1]; For a max-length block response (length byte = 255 + up to 1 PEC byte), the i2c controller is told to write 257 bytes into a 256-byte buffer, putting one byte past the end of read_buf. The same response also makes the subsequent PEC compare if (crc != msgs[1].buf[msgs[1].buf[0] + 1]) read a byte beyond the array. Bump the read_buf declaration to ADM1266_PMBUS_BLOCK_MAX + 2 so the buffer can hold the length byte, up to 255 payload bytes, and the PEC byte the i2c_msg length already accounts for.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 407dc802a9c0809ca6a48de4b4c63305eb84ef56 <472744f69d25a2d5111ad62f1d62579dce2c13c8; patch: 6.6.142; 407dc802a9c0809ca6a48de4b4c63305eb84ef56 <487566cb1ccdf3756fdd7bf8d875e612ff3169bb; 407dc802a9c0809ca6a48de4b4c63305eb84ef56 <528a9f88e88502d0c2f2052a279415074cd83715; 407dc802a9c0809ca6a48de4b4c63305eb84ef56 <bd5be3fa5de6dbf61f1b3cec6b79c2c2f8065694; patch: 0; 407dc802a9c0809ca6a48de4b4c63305eb84ef56 <d94ceb16e55b6d8019ab069e357c76ac42f0ffbc; patch: 5.10.258; patch: 6.18.34; 5.10; patch: 6.12.92; patch: 7.1; 407dc802a9c0809ca6a48de4b4c63305eb84ef56 <2279c342d94eca225bf9f301c8806a05a1c81619; 407dc802a9c0809ca6a48de4b4c63305eb84ef56 <397d3f523bfff2f4e3dacf9b1339bd76dc207f78; 407dc802a9c0809ca6a48de4b4c63305eb84ef56 <a6c802145a8de0830bca803c6d415f7e9e683624; patch: 5.15.209; patch: 7.0.11; patch: 6.1.175

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.