CVE-2026-64084
hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) { ... } where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR = 25. gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip), so the iteration walks find_next_bit() up to 242, reading up to 217 extra bits (a handful of unsigned-long words: four on 64-bit, seven on 32-bit) of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds. Substitute ADM1266_PDIO_NR for the constant so the scan stops at the last real PDIO bit.
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 19, 2026, 4:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64084
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel to the latest version.
- Apply the patch for the hwmon module.
- Limit the PDIO scan to the correct number of bits.
- Ensure correct constants are used for iteration bounds.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64084.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64084 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64084
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64084 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64084 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'd98dfad35c38c037b37c4adc99df01da571031a5', 'lessThan': 'd0593e15fdeb56048a72c5c6e720f702759d0ccd', 'versionType': 'git'}, {'status': 'affected', 'version': 'd98dfad35c38c037b37c4adc99df01da571031a5', 'lessThan': '17cee2f59029039416e8f6303050038eb59ba149', 'versionType': 'git'}, {'status': 'affected', 'version': 'd98dfad35c38c037b37c4adc99df01da571031a5', 'lessThan': '299efd14c2eda7e5fd40025e54addd4151a01081', 'versionType': 'git'}, {'status': 'affected', 'version': 'd98dfad35c38c037b37c4adc99df01da571031a5', 'lessThan': '4d1da9a6be5a8156c532d571c2ed237169f99244', 'versionType': 'git'}, {'status': 'affected', 'version': 'd98dfad35c38c037b37c4adc99df01da571031a5', 'lessThan': 'b96c7f0bc0713dc6403912f6527d4ff9168d6fe6', 'versionType': 'git'}, {'status': 'affected', 'version': 'd98dfad35c38c037b37c4adc99df01da571031a5', 'lessThan': 'fa7ca363069a70b0d1aa51e8892e3095fe2ac1ec', 'versionType': 'git'}, {'status': 'affected', 'version': 'd98dfad35c38c037b37c4adc99df01da571031a5', 'lessThan': '2aef8f08c479f4cbc83e1e6b19d1c94d4dd24f17', 'versionType': 'git'}, {'status': 'affected', 'version': 'd98dfad35c38c037b37c4adc99df01da571031a5', 'lessThan': 'd7834d92251baade796812876e95555e2066fa9f', 'versionType': 'git'}], 'programFiles': ['drivers/hwmon/pmbus/adm1266.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.10'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.10', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.142', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.92', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.34', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.11', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/hwmon/pmbus/adm1266.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) { ... } where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), not the number of PDIO pins. The intended upper bound is ADM1266_GPIO_NR + ADM1266_PDIO_NR = 25. gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip), so the iteration walks find_next_bit() up to 242, reading up to 217 extra bits (a handful of unsigned-long words: four on 64-bit, seven on 32-bit) of whatever lives past the end of the mask in the caller's stack. Any incidental set bit in that range then drives a set_bit(gpio_nr, bits) call that writes past the end of the caller-supplied bits array too -- both out-of-bounds. Substitute ADM1266_PDIO_NR for the constant so the scan stops at the last real PDIO bit. Added Reference https://git.kernel.org/stable/c/17cee2f59029039416e8f6303050038eb59ba149 Added Reference https://git.kernel.org/stable/c/299efd14c2eda7e5fd40025e54addd4151a01081 Added Reference https://git.kernel.org/stable/c/2aef8f08c479f4cbc83e1e6b19d1c94d4dd24f17 Added Reference https://git.kernel.org/stable/c/4d1da9a6be5a8156c532d571c2ed237169f99244 Added Reference https://git.kernel.org/stable/c/b96c7f0bc0713dc6403912f6527d4ff9168d6fe6 Added Reference https://git.kernel.org/stable/c/d0593e15fdeb56048a72c5c6e720f702759d0ccd Added Reference https://git.kernel.org/stable/c/d7834d92251baade796812876e95555e2066fa9f Added Reference https://git.kernel.org/stable/c/fa7ca363069a70b0d1aa51e8892e3095fe2ac1ec