CVE-2026-64497
Received Received - Intake

Sign-Extension Bug in Linux Kernel IIO SCD30 Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELD_GET(). Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELD_GET(). The current variable declaration and initializations are barely readable and use comma separations across multiple lines. Refactor the initializations so that mantissa and exp have separate declarations and sign gets initialized later. In addition (and due to the nature of the cleanup), fix a sign-extension bug where, float32 would get bitwise anded with ~BIT(31) (which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-08-14
AI Q&A
2026-07-25
EPSS Evaluated
2026-08-13
NVD
CVE-2026-64497
EUVD
EUVD-2026-48841

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a sign-extension bug in the scd30 IIO chemical sensor driver. During cleanup efforts, developers replaced manual bit manipulation with FIELD_GET() and refactored variable initializations for better readability. However, this exposed a bug where float32 values were incorrectly bitwise ANDed with ~BIT(31), corrupting the exponent due to improper sign handling.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO chemical sensor subsystem, particularly the scd30 driver. Detection requires checking the kernel version and the affected driver code. Use commands like 'uname -a' to check kernel version and 'modinfo iio_sc30' to inspect the driver. If your system uses a vulnerable kernel version (likely 5.15 or earlier), the driver may contain the sign-extension bug.

Impact Analysis

If exploited, this bug could lead to incorrect sensor readings from the scd30 device, potentially causing system malfunctions or unreliable data in applications relying on accurate chemical measurements. The impact is limited to systems using this specific driver.

Compliance Impact

This vulnerability is a low-level kernel issue in the IIO chemical sensor subsystem and does not directly impact compliance with standards like GDPR or HIPAA. It involves a sign-extension bug in the scd30 driver but does not involve data exposure or privacy concerns relevant to these regulations.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version where this vulnerability is resolved. Check your distribution's security updates or compile a kernel with the fix applied. If using a custom or embedded system, review and update the scd30 driver code to address the sign-extension bug and refactor initializations as described in the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64497. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart