An out-of-bounds memory vulnerability in the Linux kernel adm1266 hardware monitoring driver allows authenticated local attackers to compromise system confidentiality, integrity, and availability.

This is an out-of-bounds read and write vulnerability caused by an incorrect upper bound calculation in the adm1266_gpio_get_multiple function, requiring local access with low privileges and no user interaction.

Successful exploitation of this kernel vulnerability allows an attacker with local access to read and write sensitive kernel stack memory, potentially leading to privilege escalation, arbitrary code execution, or system crashes resulting in denial of service. The assigned CVSS score of 7.8 reflects a high severity risk that can compromise the underlying operating system and any hosted business applications.

Immediate Action: Update the Linux kernel to version 5.10.258, 5.15.209, 6.1.175, 6.6.142, or later depending on your active kernel branch.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unusual hardware monitoring driver errors that might indicate exploitation attempts.

Compensating Controls: Restrict local shell access and enforce strict the Principle of Least Privilege to minimize the number of users who can interact with hardware monitoring interfaces.

Public Exploit Available: No (false / unknown)

Organizations running affected Linux kernel branches should prioritize applying the official kernel patches during the next maintenance window. Because local vulnerabilities can serve as a secondary phase in multi-stage attacks, ensuring that local system users are strictly audited and the kernel is updated remains a critical defense priority.