CVE-2026-63932: iio: chemical: mhz19b: reject oversized serial replies

Q: What systems are exposed to this issue?

Systems using the Linux kernel MH-Z19B chemical sensor driver are exposed if the driver receives serial data from the sensor. The affected component is the iio: chemical: mhz19b driver.

Q: What does an attacker need to exploit it?

An attacker needs the ability to cause an oversized serial reply to be delivered to the MH-Z19B driver's receive callback. The vulnerability is locally exploitable and requires low privileges; no user interaction is required.

Q: What happens when an oversized reply is received after the fix?

The driver rejects the reply before copying it into its fixed receive buffer, wakes the waiting command path, and reports -EMSGSIZE. This prevents the serial data from overwriting st->buf.

Published Jul 19, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

iio: chemical: mhz19b: reject oversized serial replies

mhz19breceivebuf() appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space. A large callback can therefore overflow st->buf before the command path validates the reply.

Reset the reply state before each command and reject oversized serial replies before copying them into the fixed buffer. When an oversized reply is detected, wake the waiter and report -EMSGSIZE instead of overwriting st->buf.

Affected Software

138 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=6.16<6.18.35

Linux Linux kernel>=6.19<7.0.12

Linux Linux kernel=7.1-rc1

Linux Linux kernel=7.1-rc2

Linux Linux kernel=7.1-rc3

Linux Linux kernel=7.1-rc4

Linux Linux kernel=7.1-rc5

debian/linux<7.0.12-1

7.0.12-1

linux/kernel>=6.16.0<6.18.35

6.18.35

linux/kernel>=6.19.0<7.0.12

7.0.12

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1011.11~24.04.1

7.0.0-1011.11~24.04.1

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-28.28~24.04.1

7.0.0-28.28~24.04.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0<7.0.0-1016.16~24.04.1

7.0.0-1016.16~24.04.1

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0<7.0.0-1011.11~24.04.1

7.0.0-1011.11~24.04.1

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-28.28.1~24.04.3

7.0.0-28.28.1~24.04.3

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux<7.0.0-28.28

7.0.0-28.28

ubuntu/linux-aws<7.0.0-1009.9

7.0.0-1009.9

ubuntu/linux-azure<7.0.0-1010.10

7.0.0-1010.10

ubuntu/linux-azure-fde<7.0.0-1009.9

7.0.0-1009.9

ubuntu/linux-gcp<7.0.0-1008.8

7.0.0-1008.8

ubuntu/linux-gke<7.0.0-1003.4

7.0.0-1003.4

ubuntu/linux-ibm<7.0.0-1010.10

7.0.0-1010.10

ubuntu/linux-nvidia<7.0.0-1016.16

7.0.0-1016.16

ubuntu/linux-nvidia-bos<7.0.0-2016.16

7.0.0-2016.16

ubuntu/linux-oem-7.0<7.0.0-1009.9

7.0.0-1009.9

ubuntu/linux-oracle<7.0.0-1008.8

7.0.0-1008.8

ubuntu/linux-raspi<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-realtime<7.0.0-28.28.1

7.0.0-28.28.1

ubuntu/linux-riscv<7.0.0-28.28.1

7.0.0-28.28.1

Remediation

Event History

Jul 19, 2026

CVE Published

via MITRE·02:55 PM

Data Sourced

via MITRE·02:55 PM

Description

Data Sourced

via OSV·02:55 PM

DescriptionAffected Software

Data Sourced

via NVD·04:17 PM

RemedyDescriptionSeverityAffected Software

Data Sourced

via OSV·04:17 PM

Severity

Frequently Asked Questions

What systems are exposed to this issue?

Systems using the Linux kernel MH-Z19B chemical sensor driver are exposed if the driver receives serial data from the sensor. The affected component is the iio: chemical: mhz19b driver.

What does an attacker need to exploit it?

An attacker needs the ability to cause an oversized serial reply to be delivered to the MH-Z19B driver's receive callback. The vulnerability is locally exploitable and requires low privileges; no user interaction is required.

What happens when an oversized reply is received after the fix?

The driver rejects the reply before copying it into its fixed receive buffer, wakes the waiting command path, and reports -EMSGSIZE. This prevents the serial data from overwriting st->buf.

Is a patch available?

Yes. A patch is available, with stable kernel references provided for the remediation.

CVE-2026-63932: iio: chemical: mhz19b: reject oversized serial replies

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

What systems are exposed to this issue?

What does an attacker need to exploit it?

What happens when an oversized reply is received after the fix?

Is a patch available?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this issue?

What does an attacker need to exploit it?

What happens when an oversized reply is received after the fix?

Is a patch available?