CVE-2026-64495
Description
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip: for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) { if (bmg160_samp_freq_table[i].bw_bits == bw_bits) break; } *val = bmg160_samp_freq_table[i].filter; If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160_set_filter() has the same shape, driven by 'val' instead of bw_bits. smatch flags both: drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 Return -EINVAL when no entry matches. The set_filter() path is reachable from userspace via the sysfs in_anglvel_filter_low_pass_3db_frequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160_samp_freq_table[].filter.
How to fix
- Linux Linux1dc3a833be11e5d503038e3c701745fd0e03903c, 77e56ebb1786f4296afd5fa46975a989b285ae65, 029481cddb98697716f4bf3021d035eaf2ca0e1f, 8d202515baea4e2e3be448d1590099af28f2346d, d85ee50f58dd83fe74f6d0bf8bd345c657b216e8, 7bbf02b63961fc1768c9c654392c11f2077d4c59, 6c8675468862161d1c59130266852b66867d3861, 8320c77e67382d5d55d77043a5f60a867d408a2b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc ≤ v < 1dc3a833be11e5d503038e3c701745fd0e03903c, 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc ≤ v < 77e56ebb1786f4296afd5fa46975a989b285ae65, 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc ≤ v < 029481cddb98697716f4bf3021d035eaf2ca0e1f, 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc ≤ v < 8d202515baea4e2e3be448d1590099af28f2346d, 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc ≤ v < d85ee50f58dd83fe74f6d0bf8bd345c657b216e8, 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc ≤ v < 7bbf02b63961fc1768c9c654392c11f2077d4c59, 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc ≤ v < 6c8675468862161d1c59130266852b66867d3861, 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc ≤ v < 8320c77e67382d5d55d77043a5f60a867d408a2b, 3.18 | 1dc3a833be11e5d503038e3c701745fd0e03903c, 77e56ebb1786f4296afd5fa46975a989b285ae65, 029481cddb98697716f4bf3021d035eaf2ca0e1f, 8d202515baea4e2e3be448d1590099af28f2346d, d85ee50f58dd83fe74f6d0bf8bd345c657b216e8, 7bbf02b63961fc1768c9c654392c11f2077d4c59, 6c8675468862161d1c59130266852b66867d3861, 8320c77e67382d5d55d77043a5f60a867d408a2b |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.