CVE-2026-64495

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

iio: gyro: bmg160: bail out when bandwidth/filter is not in table

bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry

matching the bw_bits value read from the chip:

for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) {

if (bmg160_samp_freq_table[i].bw_bits == bw_bits)

break;

}

*val = bmg160_samp_freq_table[i].filter;

If no entry matches, i ends up equal to the array size and the next line

reads one slot past the end. bmg160_set_filter() has the same shape, driven

by 'val' instead of bw_bits.

smatch flags both:

drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error:

buffer overflow 'bmg160_samp_freq_table' 7 <= 7

drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error:

buffer overflow 'bmg160_samp_freq_table' 7 <= 7

Return -EINVAL when no entry matches.

The set_filter() path is reachable from userspace via the sysfs

in_anglvel_filter_low_pass_3db_frequency int

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References