CVE-2026-64085: hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer

adm1266_pmbus_block_xfer() copies the device-supplied block payload
into the caller-provided buffer using the device-supplied length:

	memcpy(data_r, &msgs[1].buf[1], msgs[1].buf[0]);

The helper does not know how large data_r is and trusts the device to
return at most one record's worth of bytes.  adm1266_nvmem_read_blackbox()
violates that contract: it advances read_buff inside data->dev_mem in
ADM1266_BLACKBOX_SIZE (64-byte) strides while the helper is willing to
write up to ADM1266_PMBUS_BLOCK_MAX (255) bytes.  A device that returns
more than 64 bytes on the trailing record (read_buff offset 1984 in
the 2048-byte dev_mem allocation) overflows dev_mem by up to 191 bytes
before the post-call

	if (ret != ADM1266_BLACKBOX_SIZE)
		return -EIO;

can reject the response.

Contain the fix in the caller without changing the helper signature:
read each record into a 255-byte local bounce buffer that matches the
helper's maximum output, validate the returned length, and only then
copy exactly ADM1266_BLACKBOX_SIZE bytes into the dev_mem slot.

The Linux kernel CVE team has assigned CVE-2026-64085 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 5.10.258 with commit 7896d87cbb05e097efc113243d4e38f9f8cea16c
	Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 5.15.209 with commit 9d5309500b4607b7198e19f0a3fa13eb864cd5fb
	Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 6.1.175 with commit 6098634cfa711f11a8d65368dc51ec8f7c8241ba
	Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 6.6.142 with commit 60c4b9fe1a3dd012014b1f561a6928a0b5db1126
	Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 6.12.92 with commit 83e039f0a43e0708515b0479cb7690fb93faaaa0
	Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 6.18.34 with commit 97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f
	Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 7.0.11 with commit dd47b8c4a0a8ced442da3f008db28fbbd31feaf0
	Issue introduced in 5.10 with commit 407dc802a9c0809ca6a48de4b4c63305eb84ef56 and fixed in 7.1 with commit 43cae21424ff8e33894a0f86c6b80b840c049fd7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64085
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/hwmon/pmbus/adm1266.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7896d87cbb05e097efc113243d4e38f9f8cea16c
	https://git.kernel.org/stable/c/9d5309500b4607b7198e19f0a3fa13eb864cd5fb
	https://git.kernel.org/stable/c/6098634cfa711f11a8d65368dc51ec8f7c8241ba
	https://git.kernel.org/stable/c/60c4b9fe1a3dd012014b1f561a6928a0b5db1126
	https://git.kernel.org/stable/c/83e039f0a43e0708515b0479cb7690fb93faaaa0
	https://git.kernel.org/stable/c/97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f
	https://git.kernel.org/stable/c/dd47b8c4a0a8ced442da3f008db28fbbd31feaf0
	https://git.kernel.org/stable/c/43cae21424ff8e33894a0f86c6b80b840c049fd7