CVE-2026-64083 hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
A Linux kernel driver flaw allows leaking kernel stack memory to userspace via GPIO accessors when a device returns short I2C responses.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64083?
CVE-2026-64083 is a medium-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
adm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the pin-status word as
pins_status = read_buf[0] + (read_buf[1] << 8);
right after i2c_smbus_read_block_data(), guarding only against an error return. A well-behaved device returns 2 bytes for GPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or 1-byte response too. If the device returns 0 bytes, both read_buf slots are uninitialized stack memory; if it returns 1 byte, read_buf[1] is.
The composed value then flows through set_bit() into the caller's *bits in adm1266_gpio_get_multiple(), or into the return value of adm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and the char-dev ioctls). That leaks a few bits of kernel stack per request on any device whose firmware glitch, bus error, or hostile slave produces a short block-read response.
Add the missing length check to both call sites and surface a short response as -EIO.
Which versions are affected by CVE-2026-64083?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64083?
Apply the vendor's patch.
Is CVE-2026-64083 being exploited?
There is no known exploitation of CVE-2026-64083 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64083, DEBIAN-CVE-2026-64083, GHSA-9794-j36c-v322, UBUNTU-CVE-2026-64083.