PT-2026-64716 · Linux · Linux

CVE-2026-64495

·

Published

2026-07-25

·

Updated

2026-07-25

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: bmg160: bail out when bandwidth/filter is not in table
bmg160 get filter() walks bmg160 samp freq table[] looking for the entry matching the bw bits value read from the chip:
for (i = 0; i < ARRAY SIZE(bmg160 samp freq table); ++i) {
	if (bmg160 samp freq table[i].bw bits == bw bits)
		break;
}
*val = bmg160 samp freq table[i].filter;
If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160 set filter() has the same shape, driven by 'val' instead of bw bits.
smatch flags both:
drivers/iio/gyro/bmg160 core.c:204 bmg160 get filter() error: buffer overflow 'bmg160 samp freq table' 7 <= 7 drivers/iio/gyro/bmg160 core.c:222 bmg160 set filter() error: buffer overflow 'bmg160 samp freq table' 7 <= 7
Return -EINVAL when no entry matches.
The set filter() path is reachable from userspace via the sysfs in anglvel filter low pass 3db frequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160 samp freq table[].filter.
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-64495

Affected Products

Linux