CVE-2026-31764
Buffer Sampling Frequency OOB in ST LSM6DSX Kernel Driver
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| stmicroelectronics | st_lsm6dsx | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel driver for the st_lsm6dsx sensor. Specifically, the function st_lsm6dsx_hwfifo_odr_store() allows userspace to set the buffer sampling frequency for sensors. It calls another function, st_lsm6dsx_check_odr(), which accesses an array called odr_table using the sensor's ID as an index. However, this array only has two entries, corresponding to the accelerometer and gyroscope sensors. If the sensor type is anything other than these two, the code attempts to access the array out-of-bounds, leading to a potential out-of-bounds memory access.
The root cause is that the buffer sampling frequency attribute is created for all sensor types, but only accelerometer data supports the event types that require this attribute. The fix was to restrict the creation of this attribute to accelerometer sensors only, preventing out-of-bounds access.
How can this vulnerability impact me? :
An out-of-bounds access in kernel code can lead to undefined behavior, including potential system crashes, data corruption, or security issues such as privilege escalation or information disclosure. Since this vulnerability involves accessing memory outside the bounds of an array, it could be exploited to compromise system stability or security.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by ensuring that the buffer sampling frequency sysfs attribute is only created for the accelerometer sensor type, preventing out-of-bounds access in the st_lsm6dsx driver.
Immediate mitigation steps include updating the Linux kernel to a version where this issue is fixed, which restricts the buffer sampling frequency setting to the accelerometer sensor only.