CVE-2026-98660: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In bmp280 sampling-frequency lookup, convert num_sampling_freq_avail from the flattened integer-element count returned by read_avail() back to the number of table rows before iterating over the two-dimensional sampling-frequency table.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel BMP280 pressure sensor driver are exposed when the driver processes sampling-frequency configuration. The provided data does not identify affected kernel versions or hardware configurations.
What action triggers the out-of-bounds access?
The issue is triggered in bmp280_write_sampling_frequency() when it iterates the sampling-frequency lookup table using a flattened element count as though it were the number of table rows. An attacker or local actor would need a way to request a sampling-frequency change through the affected driver interface.
How can I tell whether a fix is present?
Check whether your kernel includes the change that converts num_sampling_freq_avail from the flattened integer-element count to the number of sampling-frequency table rows before bmp280_write_sampling_frequency() iterates the table. The supplied stable-kernel references identify commits containing the fix.