CVE-2026-98660

The Linux kernel contains an out-of-bounds access vulnerability within the iio: pressure: bmp280 driver during a sampling frequency lookup. The root cause is that the bmp280_write_sampling_frequency() function indexes the sampling frequency table as a two-dimensional array using num_sampling_freq...

CVE-2026-98660 iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup The sampling frequency tables store each frequency as an integer part and a fractional part in micro units. numsamplingfreqavail is initialized to the...

EUVD-2026-103914

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup The sampling frequency tables store each frequency as an integer part and a fractional part in micro units. numsamplingfreqavail is initialized to the...

CVE-2026-98660 iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup The sampling frequency tables store each frequency as an integer part and a fractional part in micro units. numsamplingfreqavail is initialized to the...

CVE-2026-98659

The Linux kernel contains a vulnerability in the iio: pressure: rohm-bm1390 driver where the data reading function ignores cached error values and unconditionally returns 0. This causes the system to potentially return garbage data to the user instead of indicating a read failure. The fix involve...

CVE-2026-98659 iio: pressure: rohm-bm1390: Return error when read fails

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read...

CVE-2026-98659 iio: pressure: rohm-bm1390: Return error when read fails

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read...

EUVD-2026-103913

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read...

CVE-2026-98658

The Linux kernel contains a vulnerability in the iio: proximity: aw96103 driver where the firmware parser fails to properly validate the length field from the binary header. A truncated firmware image can cause the parser to read beyond the buffer, while a value smaller than the four-byte count f...

CVE-2026-98658 iio: proximity: aw96103: validate firmware data length

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond...

EUVD-2026-103912

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond...

CVE-2026-98658 iio: proximity: aw96103: validate firmware data length

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond...

CVE-2026-98657 iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iiodevice left registered on PM setup failure pmruntimesetactive failing in probe jumps to errorunregbuffer, which only calls iiotriggeredbuffercleanup -- it does not undo the iiodeviceregister th...

EUVD-2026-103911

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iiodevice left registered on PM setup failure pmruntimesetactive failing in probe jumps to errorunregbuffer, which only calls iiotriggeredbuffercleanup -- it does not undo the iiodeviceregister th...

CVE-2026-98657

The Linux kernel contains a vulnerability in the iio: proximity: pulsedlight driver where a failure in pm_runtime_set_active() during the probe() function leads to an incomplete cleanup. Specifically, the code jumps to error_unreg_buffer, which calls iio_triggered_buffer_cleanup() but fails to un...

CVE-2026-98657 iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iiodevice left registered on PM setup failure pmruntimesetactive failing in probe jumps to errorunregbuffer, which only calls iiotriggeredbuffercleanup -- it does not undo the iiodeviceregister th...

EUVD-2026-103910

In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenablework before freeing trigger iiotriggernotifydoneatomic defers -reenable into trig-reenablework on the system workqueue, and the worker dereferences the owning trigger through containerof. Nothing...

CVE-2026-98656

A vulnerability exists in the Linux kernel 's iio: trigger subsystem. The function iio_trigger_notify_done_atomic() defers reenable() into trig->reenable_work on the system workqueue, where a worker dereferences the owning trigger using container_of(). Because this work is not cancelled before...

CVE-2026-98656 iio: trigger: cancel reenable_work before freeing trigger

In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenablework before freeing trigger iiotriggernotifydoneatomic defers -reenable into trig-reenablework on the system workqueue, and the worker dereferences the owning trigger through containerof. Nothing...

CVE-2026-98656 iio: trigger: cancel reenable_work before freeing trigger

In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenablework before freeing trigger iiotriggernotifydoneatomic defers -reenable into trig-reenablework on the system workqueue, and the worker dereferences the owning trigger through containerof. Nothing...