CVE-2026-64495 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the iio: gyro: bmg160 module. These parties should assess their exposure and prioritize remediation. Additionally, system administrators and security teams responsible for Linux-based systems should review their configurations and ensure that necessary patches are applied.

Why it matters

This vulnerability allows an attacker to potentially read sensitive information or cause a system crash by exploiting the buffer overflow in the Linux kernel's iio: gyro: bmg160 module. Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems that utilize this module should assess their exposure and prioritize remediation.

• Potential out-of-bounds read and information disclosure
• Possible system crash or instability
• Increased risk of privilege escalation
• Requires verification of affected versions and remediation from official sources

Technical summary

The bmg160_get_filter() and bmg160_set_filter() functions in the Linux kernel's iio: gyro: bmg160 module do not properly validate bandwidth/filter values. This can cause an out-of-bounds read when accessing the bmg160_samp_freq_table[] array. The issue is reachable from userspace via the sysfs in_anglvel_filter_low_pass_3db_frequency interface. The functions iterate over the bmg160_samp_freq_table[] array to find a matching entry, but do not check if the entry exists. If no entry matches, the functions will read one slot past the end of the array, resulting in an out-of-bounds read. The vulnerability has been resolved with a patch that returns -EINVAL when no entry matches.

Defensive priority

Medium

Recommended defensive actions

• Review and update Linux kernel packages to ensure the latest security patches are applied
• Restrict access to the sysfs in_anglvel_filter_low_pass_3db_frequency interface to prevent exploitation
• Monitor system logs for potential exploitation attempts
• Perform a thorough review of system configurations and user permissions
• Implement additional monitoring and logging to detect potential attacks
• Verify that all necessary patches are applied and up-to-date
• Conduct a thorough risk assessment to identify potential vulnerabilities

Evidence notes

The vulnerability is caused by the lack of validation for bandwidth/filter values in the bmg160_get_filter() and bmg160_set_filter() functions. The functions iterate over the bmg160_samp_freq_table[] array to find a matching entry, but do not check if the entry exists. If no entry matches, the functions will read one slot past the end of the array, resulting in an out-of-bounds read.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.