CVE-2025-39719
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-05

Last updated on: 2025-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: imu: bno055: fix OOB access of hw_xlate array Fix a potential out-of-bounds array access of the hw_xlate array in bno055.c. In bno055_get_regmask(), hw_xlate was iterated over the length of the vals array instead of the length of the hw_xlate array. In the case of bno055_gyr_scale, the vals array is larger than the hw_xlate array, so this could result in an out-of-bounds access. In practice, this shouldn't happen though because a match should always be found which breaks out of the for loop before it iterates beyond the end of the hw_xlate array. By adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be sure we are iterating over the correct length.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-05
Last Modified
2025-11-03
Generated
2026-05-27
AI Q&A
2025-09-05
EPSS Evaluated
2026-05-25
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
vendor linux 6.1.153-1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is an out-of-bounds (OOB) array access issue in the Linux kernel's bno055 driver. Specifically, in the function bno055_get_regmask(), the code iterates over the hw_xlate array using the length of a different array (vals), which can be larger. This mismatch can cause the code to access memory beyond the bounds of the hw_xlate array, potentially leading to undefined behavior or crashes. The fix involved adding a new hw_xlate_len field to ensure the iteration uses the correct array length.


How can this vulnerability impact me? :

This vulnerability could lead to out-of-bounds memory access in the Linux kernel, which might cause system instability, crashes, or potentially allow an attacker to exploit the kernel for further malicious actions. However, in practice, the issue is unlikely to occur because the code is designed to break out of the loop once a match is found, preventing iteration beyond the array's end.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart