CVE-2026-64083
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
adm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the
pin-status word as
pins_status = read_buf[0] + (read_buf[1] << 8);
right after i2c_smbus_read_block_data(), guarding only against an
error return. A well-behaved device returns 2 bytes for
GPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or
1-byte response too. If the device returns 0 bytes, both read_buf
slots are uninitialized stack memory; if it returns 1 byte, read_buf[1]
is.
The composed value then flows through set_bit() into the caller's
*bits in adm1266_gpio_get_multiple(), or into the return value of
adm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and
the char-dev ioctls). That leaks a few bits of kernel stack per
request on any device whose firmware glitch, bus error, or hostile
slave produces a short block-read response.
Add the missing length check to both call sites and surface a short
response as -EIO.
CSIRTS triage
- What
- Multiple kernel flaws including NTFS file system out-of-bounds read, AMD processor floating point unit data exposure, and AMD Zen 2 operation cache isolation failure.
- Who is affected
- Systems running affected Linux kernel versions; local attackers on systems with NTFS mounted or AMD processors.
- Urgency
- Moderate to high — local attackers can gain privilege escalation and information disclosure; apply patches promptly.
- Action
- Apply kernel security updates provided by distribution maintainer.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-64083
Get an email if CVE-2026-64083 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
Advisory coverage (19)
- unknownUSN-8729-1: Linux kernel vulnerabilitiesubuntu · 2026-09-07
- unknownexploitedUSN-8728-1: Linux kernel (GCP) vulnerabilitiesubuntu · 2026-09-07
- unknownUSN-8668-1: Linux kernel (GCP) vulnerabilitiesubuntu · 2026-08-21
- unknownUSN-8664-1: Linux kernel (NVIDIA BaseOS) vulnerabilitiesubuntu · 2026-08-20
- unknownUSN-8663-1: Linux kernel (NVIDIA) vulnerabilitiesubuntu · 2026-08-20
- unknownUSN-8620-4: Linux kernel (Intel IoTG) vulnerabilitiesubuntu · 2026-07-31
- unknownUSN-8620-3: Linux kernel (Intel IoTG) vulnerabilitiesubuntu · 2026-07-31
- unknownUSN-8620-2: Linux kernel (Azure FIPS) vulnerabilitiesubuntu · 2026-07-29
- highUSN-8620-1: Linux kernel vulnerabilitiesubuntu · 2026-07-28
- highUSN-8618-1: Linux kernel vulnerabilitiesubuntu · 2026-07-28
- highUSN-8610-1: Linux kernel (Azure CVM) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8575-3: Linux kernel vulnerabilitiesubuntu · 2026-07-24
- highUSN-8603-1: Linux kernel (Azure) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8576-2: Linux kernel (NVIDIA Tegra) vulnerabilitiesubuntu · 2026-07-23
- highUSN-8575-2: Linux kernel vulnerabilitiesubuntu · 2026-07-23
- highUSN-8593-1: Linux kernel vulnerabilitiesubuntu · 2026-07-23
- highUSN-8576-1: Linux kernel (NVIDIA Tegra) vulnerabilitiesubuntu · 2026-07-21
- highUSN-8575-1: Linux kernel vulnerabilitiesubuntu · 2026-07-21
- unknownCVE-2026-64083: In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) rej…nvd · 2026-07-19
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-64083)