CVE-2026-63932

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

iio: chemical: mhz19b: reject oversized serial replies

mhz19b_receive_buf() appends each serdev chunk into the fixed

MHZ19B_CMD_SIZE receive buffer and advances buf_idx by len without

checking that the chunk fits in the remaining space. A large callback

can therefore overflow st->buf before the command path validates the

reply.

Reset the reply state before each command and reject oversized serial

replies before copying them into the fixed buffer. When an oversized

reply is detected, wake the waiter and report -EMSGSIZE instead of

overwriting st->buf.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References