CVE-2026-64495
Received Received - Intake

Buffer Overflow in Linux Kernel IIO Gyro BMG160 Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip: for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) { if (bmg160_samp_freq_table[i].bw_bits == bw_bits) break; } *val = bmg160_samp_freq_table[i].filter; If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160_set_filter() has the same shape, driven by 'val' instead of bw_bits. smatch flags both: drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 Return -EINVAL when no entry matches. The set_filter() path is reachable from userspace via the sysfs in_anglvel_filter_low_pass_3db_frequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160_samp_freq_table[].filter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-08-14
AI Q&A
2026-07-25
EPSS Evaluated
2026-08-13
NVD
CVE-2026-64495
EUVD
EUVD-2026-48839

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bosch bmg160 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's IIO gyroscope driver for the Bosch BMG160 sensor. The issue occurs in the bmg160_get_filter() and bmg160_set_filter() functions when handling bandwidth or filter values not present in the supported table. The code fails to validate input, leading to an out-of-bounds array access.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO gyro driver for the BMG160 sensor. Detection requires checking if the affected driver is present and if the kernel version is vulnerable. Use commands like 'lsmod | grep bmg160' to check if the module is loaded and 'uname -a' to verify the kernel version.

Impact Analysis

An attacker with access to the affected system could trigger a buffer overflow by writing an invalid filter value via the sysfs interface. This may cause memory corruption, crashes, or potentially allow privilege escalation. The vulnerability is reachable from userspace, making it exploitable without special permissions.

Compliance Impact

This vulnerability is a buffer overflow in the Linux kernel's IIO gyro driver for the BMG160 sensor. It allows userspace to trigger an out-of-bounds read via a sysfs interface, which could lead to memory corruption or crashes. However, the provided context does not specify any direct impact on compliance with standards like GDPR or HIPAA.

Mitigation Strategies

Apply the latest kernel update that patches this vulnerability. If immediate patching is not possible, disable the BMG160 driver by unloading the module with 'rmmod bmg160' or blacklisting it. Restrict access to the sysfs interface '/sys/bus/iio/devices/iio:deviceX/in_anglvel_filter_low_pass_3db_frequency' to prevent userspace exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64495. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart