CVE-2026-98835

Received Received - Intake

Array Index Out of Bounds in Linux Kernel IIO Accelerometer Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeof(array) as a last index, when last valid index should be sizeof(array) - 1. Fix the check by bailing out when index >= sizeof(array).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98835

EUVD

EUVD-2026-103775

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	7c1d1677b3227c6b18ac999f2b84778baa280b8f
Linux	Linux	7c1d1677b3227c6b18ac999f2b84778baa280b8f
Linux	Linux	7c1d1677b3227c6b18ac999f2b84778baa280b8f
Linux	Linux	7c1d1677b3227c6b18ac999f2b84778baa280b8f
Linux	Linux	6.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's IIO accelerometer driver for the Kionix KX022A sensor. It involves an incorrect array boundary check when converting a register value to an array index. The check mistakenly allows the array size as a valid index, when the maximum valid index should be one less than the array size.

Detection Guidance

This vulnerability is specific to the Linux kernel driver for the Kionix KX022A accelerometer. Detection requires checking if the affected driver version is running on your system. Use commands like 'lsmod | grep kionix' to list loaded kernel modules and identify if the vulnerable driver is present.

Impact Analysis

This could lead to out-of-bounds memory access, potentially causing system crashes, data corruption, or privilege escalation if exploited by a local attacker with access to the affected driver.

Compliance Impact

This vulnerability is a low-level driver issue in the Linux kernel related to array boundary checks. It does not directly impact compliance with standards like GDPR or HIPAA as it does not involve data exposure or privacy violations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If you cannot update immediately, consider disabling the kionix-kx022a driver module if it is not required for your system.

Hi! I’m here to help you understand CVE-2026-98835. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70