CVE-2026-64495iio: gyro: bmg160: bail out when bandwidth/filter is not in table
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip: for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) { if (bmg160_samp_freq_table[i].bw_bits == bw_bits) break; } *val = bmg160_samp_freq_table[i].filter; If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160_set_filter() has the same shape, driven by 'val' instead of bw_bits. smatch flags both: drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 Return -EINVAL when no entry matches. The set_filter() path is reachable from userspace via the sysfs in_anglvel_filter_low_pass_3db_frequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160_samp_freq_table[].filter.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc builds before 1dc3a833be11e5d503038e3c701745fd0e03903c; from 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc before 77e56ebb1786f4296afd5fa46975a989b285ae65; from 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc before 029481cddb98697716f4bf3021d035eaf2ca0e1f; 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc builds before 8d202515baea4e2e3be448d1590099af28f2346d; from 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc before d85ee50f58dd83fe74f6d0bf8bd345c657b216e8; 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc builds before 7bbf02b63961fc1768c9c654392c11f2077d4c59; 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc builds before 6c8675468862161d1c59130266852b66867d3861; from 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc before 8320c77e67382d5d55d77043a5f60a867d408a2b | CNA record |
References
- https://git.kernel.org/stable/c/1dc3a833be11e5d503038e3c701745fd0e03903c
- https://git.kernel.org/stable/c/77e56ebb1786f4296afd5fa46975a989b285ae65
- https://git.kernel.org/stable/c/029481cddb98697716f4bf3021d035eaf2ca0e1f
- https://git.kernel.org/stable/c/8d202515baea4e2e3be448d1590099af28f2346d
- https://git.kernel.org/stable/c/d85ee50f58dd83fe74f6d0bf8bd345c657b216e8
- https://git.kernel.org/stable/c/7bbf02b63961fc1768c9c654392c11f2077d4c59
- https://git.kernel.org/stable/c/6c8675468862161d1c59130266852b66867d3861
- https://git.kernel.org/stable/c/8320c77e67382d5d55d77043a5f60a867d408a2b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.