CVE-2026-72480

Received Received - Intake

Out-of-Bounds Channel Lookup in Xilinx AMS Linux Kernel Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling ams_event_to_channel() may return a pointer past the end of dev->channels when no matching scan_index is found. This can lead to invalid memory access in ams_handle_event(). Add a bounds check in ams_event_to_channel() and return NULL when no channel is found. Also guard the caller to safely handle this case.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72480

EUVD

EUVD-2026-59379

Affected Vendors & Products

Vendor	Product	Version / Range
xilinx	xilinx_ams	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel related to the Xilinx Analog Mixed Signal (AMS) driver. The issue occurs in event handling where a function may return a pointer outside the valid memory range of a device's channels array. This can lead to invalid memory access and potential crashes or security issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's Xilinx AMS driver. Detection requires checking kernel logs for out-of-bounds channel access errors or crashes related to the xilinx-ams module. Use commands like dmesg | grep -i ams or journalctl -k | grep -i ams to inspect kernel logs for errors.

Impact Analysis

If you use systems with the affected Linux kernel and Xilinx AMS hardware, this vulnerability could cause system instability, crashes, or unexpected behavior during ADC event handling. It may also pose a security risk if exploited to access unauthorized memory.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level memory access issue in the Linux kernel's IIO ADC subsystem. It may indirectly impact systems handling sensitive data if exploited, but no evidence suggests direct regulatory non-compliance.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-72480. If immediate patching is not possible, disable the xilinx-ams driver module if not in use by running modprobe -r xilinx-ams.

Hi! I’m here to help you understand CVE-2026-72480. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70