PT-2026-64716 · Linux · Linux

CVE-2026-64495

·

Publicado

2026-07-25

·

Atualizado

2026-07-25

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: bmg160: bail out when bandwidth/filter is not in table
bmg160 get filter() walks bmg160 samp freq table[] looking for the entry matching the bw bits value read from the chip:
for (i = 0; i < ARRAY SIZE(bmg160 samp freq table); ++i) {
	if (bmg160 samp freq table[i].bw bits == bw bits)
		break;
}
*val = bmg160 samp freq table[i].filter;
If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160 set filter() has the same shape, driven by 'val' instead of bw bits.
smatch flags both:
drivers/iio/gyro/bmg160 core.c:204 bmg160 get filter() error: buffer overflow 'bmg160 samp freq table' 7 <= 7 drivers/iio/gyro/bmg160 core.c:222 bmg160 set filter() error: buffer overflow 'bmg160 samp freq table' 7 <= 7
Return -EINVAL when no entry matches.
The set filter() path is reachable from userspace via the sysfs in anglvel filter low pass 3db frequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160 samp freq table[].filter.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64495

Produtos afetados

Linux