CVE-2026-98680

Received Received - Intake

Memory Leak in Linux Kernel IIO Accelerometer Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022a_fifo_enable() at the buffer enable path, the allocated memory is never freed. Furthermore, the state information and previous hardware configuration(s) aren't undone, potentially leaving WMI interrupts and buffers enabled, or driver state flags wrong. Free the memory and revert the hardware configuration and state flags on error path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98680

EUVD

EUVD-2026-103934

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	e7123a4dfcd732c4d10620748588e3715f362802
Linux	Linux	e7123a4dfcd732c4d10620748588e3715f362802
Linux	Linux	e7123a4dfcd732c4d10620748588e3715f362802
Linux	Linux	e7123a4dfcd732c4d10620748588e3715f362802
Linux	Linux	6.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the kionix-kx022a accelerometer driver. When enabling the buffer, memory is allocated for samples. If a regmap operation fails during this process, the allocated memory is not freed, and hardware state is not properly reset. This leaves WMI interrupts and buffers enabled and driver state flags incorrect.

Detection Guidance

This vulnerability is specific to the Linux kernel's kionix-kx022a driver and involves memory leaks and improper state handling. Detection requires checking for active kx022a drivers and potential memory leaks in the IIO subsystem. Use commands like 'lsmod | grep kx022a' to check if the driver is loaded and 'dmesg | grep kx022a' to review kernel logs for errors. Monitor memory usage with 'cat /proc/meminfo' for unusual allocations.

Impact Analysis

This vulnerability could lead to system instability due to memory leaks and incorrect driver state. It may cause unexpected behavior in applications relying on the accelerometer, potential crashes, or resource exhaustion from unreleased memory.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a memory leak and improper state handling in a Linux kernel driver for an accelerometer device, which could lead to resource exhaustion or incorrect device behavior but does not involve data privacy or security controls relevant to these regulations.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If the driver kx022a is not in use, unload it with 'rmmod kx022a'. Ensure no applications rely on the vulnerable driver before removal. Regularly check for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-98680. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70