CVE-2026-64495
iio: gyro: bmg160: bail out when bandwidth/filter is not in table
Description
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip: for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) { if (bmg160_samp_freq_table[i].bw_bits == bw_bits) break; } *val = bmg160_samp_freq_table[i].filter; If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160_set_filter() has the same shape, driven by 'val' instead of bw_bits. smatch flags both: drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 Return -EINVAL when no entry matches. The set_filter() path is reachable from userspace via the sysfs in_anglvel_filter_low_pass_3db_frequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160_samp_freq_table[].filter.
INFO
Published Date :
July 25, 2026, 10:17 a.m.
Last Modified :
July 25, 2026, 10:17 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64495
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel to a patched version.
- Verify bandwidth and filter values.
- Ensure userspace input is validated.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64495.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64495 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64495
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64495 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64495 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc', 'lessThan': '1dc3a833be11e5d503038e3c701745fd0e03903c', 'versionType': 'git'}, {'status': 'affected', 'version': '22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc', 'lessThan': '77e56ebb1786f4296afd5fa46975a989b285ae65', 'versionType': 'git'}, {'status': 'affected', 'version': '22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc', 'lessThan': '029481cddb98697716f4bf3021d035eaf2ca0e1f', 'versionType': 'git'}, {'status': 'affected', 'version': '22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc', 'lessThan': '8d202515baea4e2e3be448d1590099af28f2346d', 'versionType': 'git'}, {'status': 'affected', 'version': '22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc', 'lessThan': 'd85ee50f58dd83fe74f6d0bf8bd345c657b216e8', 'versionType': 'git'}, {'status': 'affected', 'version': '22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc', 'lessThan': '7bbf02b63961fc1768c9c654392c11f2077d4c59', 'versionType': 'git'}, {'status': 'affected', 'version': '22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc', 'lessThan': '6c8675468862161d1c59130266852b66867d3861', 'versionType': 'git'}, {'status': 'affected', 'version': '22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc', 'lessThan': '8320c77e67382d5d55d77043a5f60a867d408a2b', 'versionType': 'git'}], 'programFiles': ['drivers/iio/gyro/bmg160_core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.18'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.18', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.4', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/iio/gyro/bmg160_core.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip: for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) { if (bmg160_samp_freq_table[i].bw_bits == bw_bits) break; } *val = bmg160_samp_freq_table[i].filter; If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160_set_filter() has the same shape, driven by 'val' instead of bw_bits. smatch flags both: drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 Return -EINVAL when no entry matches. The set_filter() path is reachable from userspace via the sysfs in_anglvel_filter_low_pass_3db_frequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160_samp_freq_table[].filter. Added Reference https://git.kernel.org/stable/c/029481cddb98697716f4bf3021d035eaf2ca0e1f Added Reference https://git.kernel.org/stable/c/1dc3a833be11e5d503038e3c701745fd0e03903c Added Reference https://git.kernel.org/stable/c/6c8675468862161d1c59130266852b66867d3861 Added Reference https://git.kernel.org/stable/c/77e56ebb1786f4296afd5fa46975a989b285ae65 Added Reference https://git.kernel.org/stable/c/7bbf02b63961fc1768c9c654392c11f2077d4c59 Added Reference https://git.kernel.org/stable/c/8320c77e67382d5d55d77043a5f60a867d408a2b Added Reference https://git.kernel.org/stable/c/8d202515baea4e2e3be448d1590099af28f2346d Added Reference https://git.kernel.org/stable/c/d85ee50f58dd83fe74f6d0bf8bd345c657b216e8