Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-64083
Linux Linux — hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U N N H 5.5 .0016 4.9 —
AFFECTED
Product Versions Fixed
Linux d98dfad35c38c037b37c4adc99df01da571031a5 – —
Linux 5.10 – 5.10.258
TIMELINE
Jul 19 Reserved by Linux
Jul 19 Published (CNA: Linux)
Sep 3 ENRICHED — CVE-2026-64083 (Linux). Received CVSS 5.5 and CPE data from NVD.
Description
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors
adm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the
pin-status word as
pins_status = read_buf[0] + (read_buf[1] << 8);
right after i2c_smbus_read_block_data(), guarding only against an
error return. A well-behaved device returns 2 bytes for
GPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or
1-byte response too. If the device returns 0 bytes, both read_buf
slots are uninitialized stack memory; if it returns 1 byte, read_buf[1]
is.
The composed value then flows through set_bit() into the caller's
*bits in adm1266_gpio_get_multiple(), or into the return value of
adm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and
the char-dev ioctls). That leaks a few bits of kernel stack per
request on any device whose firmware glitch, bus error, or hostile
slave produces a short block-read response.
Add the missing length check to both call sites and surface a short
response as -EIO.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| July 19, 2026 | Reserved | Reserved by Linux |
| July 19, 2026 | Published | Published (CNA: Linux) |
| September 3, 2026 | ENRICHED | ENRICHED — CVE-2026-64083 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Linux | Linux | — | d98dfad35c38c037b37c4adc99df01da571031a5 | — |
| Linux | Linux | — | 5.10 | 5.10.258 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-64083 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
