CVE-2026-64087 hwmon: (pmbus/adm1266) reject implausible blackbox record_count

Medium 5.5 Published 19 Jul 2026 Updated 19 Jul 2026

A missing bounds check in the Linux kernel adm1266 driver allows out-of-bounds writes via malformed device responses, potentially causing crashes or code execution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-64087?

CVE-2026-64087 is a medium-severity memory corruption vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/adm1266) reject implausible blackbox record_count

adm1266_nvmem_read_blackbox() loops over a record_count that comes straight from byte 3 of the BLACKBOX_INFO response. The destination buffer is data->dev_mem, sized for the nvmem cell's declared 2048 bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE = 32 * 64). A device that reports a record_count greater than 32 -- whether due to firmware bugs, bus corruption, or a non-responsive slave returning 0xff -- would walk read_buff past the end of the dev_mem allocation on the trailing iterations.

Cap record_count at ADM1266_BLACKBOX_MAX_RECORDS (introduced here) before entering the loop and return -EIO on any larger value, so a malformed BLACKBOX_INFO response cannot drive the loop out of bounds.

Which versions are affected by CVE-2026-64087?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-64087?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-64087 being exploited?

There is no known exploitation of CVE-2026-64087 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as BELL-CVE-2026-64087, DEBIAN-CVE-2026-64087, GHSA-p924-4557-4g43, UBUNTU-CVE-2026-64087.