CVE-2026-64135: hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX

adm1266_nvmem_read_blackbox() declares a 5-byte stack buffer and
passes it to i2c_smbus_read_block_data() to retrieve the 4-byte
BLACKBOX_INFO response.  i2c_smbus_read_block_data() does not honour
caller buffer sizes -- it memcpy()s data.block[0] bytes from the
SMBus transaction (where data.block[0] is the length byte returned by
the slave device, up to I2C_SMBUS_BLOCK_MAX = 32):

	memcpy(values, &data.block[1], data.block[0]);

If the device returns any block length above 5, the call overflows
the caller's 5-byte stack buffer before the post-call

	if (ret != 4)
		return -EIO;

check has a chance to reject the response.

Widen the local buffer to I2C_SMBUS_BLOCK_MAX so the helper has room
for any well-formed SMBus block response, matching the convention used
by the other i2c_smbus_read_block_data() callers in this driver.

The Linux kernel CVE team has assigned CVE-2026-64135 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10 with commit 15609d1893020436e1e8ccfd9ded774a96dd17a2 and fixed in 5.10.258 with commit 33251abb9c9dd62943be76f0427c5527ee39188f
	Issue introduced in 5.10 with commit 15609d1893020436e1e8ccfd9ded774a96dd17a2 and fixed in 5.15.209 with commit ba09f4baa5bd96c5d26c942defa546a72dbbe5bf
	Issue introduced in 5.10 with commit 15609d1893020436e1e8ccfd9ded774a96dd17a2 and fixed in 6.1.175 with commit 6ed16a40b162e9d87d9ac8bed4d7f0e3e807700e
	Issue introduced in 5.10 with commit 15609d1893020436e1e8ccfd9ded774a96dd17a2 and fixed in 6.6.142 with commit 0dbf64c502443c08c2e28a77ecbfcc5479d93228
	Issue introduced in 5.10 with commit 15609d1893020436e1e8ccfd9ded774a96dd17a2 and fixed in 6.12.92 with commit 2b7a698d5093b548c464828d984f05ced5f3fd2a
	Issue introduced in 5.10 with commit 15609d1893020436e1e8ccfd9ded774a96dd17a2 and fixed in 6.18.34 with commit ca560f7566df7e2826c2999e959e6b94eb938f76
	Issue introduced in 5.10 with commit 15609d1893020436e1e8ccfd9ded774a96dd17a2 and fixed in 7.0.11 with commit 7f705e581ef3e6bb308a121a89adf5237d968204
	Issue introduced in 5.10 with commit 15609d1893020436e1e8ccfd9ded774a96dd17a2 and fixed in 7.1 with commit eee213daa1e1b402eb631bcd1b8c5aa340a6b081

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64135
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/hwmon/pmbus/adm1266.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/33251abb9c9dd62943be76f0427c5527ee39188f
	https://git.kernel.org/stable/c/ba09f4baa5bd96c5d26c942defa546a72dbbe5bf
	https://git.kernel.org/stable/c/6ed16a40b162e9d87d9ac8bed4d7f0e3e807700e
	https://git.kernel.org/stable/c/0dbf64c502443c08c2e28a77ecbfcc5479d93228
	https://git.kernel.org/stable/c/2b7a698d5093b548c464828d984f05ced5f3fd2a
	https://git.kernel.org/stable/c/ca560f7566df7e2826c2999e959e6b94eb938f76
	https://git.kernel.org/stable/c/7f705e581ef3e6bb308a121a89adf5237d968204
	https://git.kernel.org/stable/c/eee213daa1e1b402eb631bcd1b8c5aa340a6b081