CVE-2026-98893

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI sensor driver. The driver fails to verify that the received notification payload size is large enough to contain all expected sensor readings before parsing them. A malicious or compromised firmware platform c...

CVE-2026-80767

A flaw was found in the Linux kernel's Human Interface Device HID sensor custom driver. A use-after-free vulnerability exists where the enablesensor sysfs attribute can be accessed either before its associated memory is properly initialized or after it has been freed during device removal. A loca...

CVE-2026-98680

A flaw was found in the Linux kernel's Kionix KX022A accelerometer sensor driver. When enabling the device buffer fails during register configuration, the driver fails to properly free allocated memory or restore previous hardware states. A local user could trigger this error condition to cause a...

CVE-2026-98661

A flaw was found in the Linux kernel's ROHM BU27034 ambient light sensor driver. When reading the sensor integration time fails, the driver improperly uses the returned error code to calculate sleep duration. A local user interacting with the sensor interface during a read failure can cause the...

CVE-2026-98665

A flaw was found in the Linux kernel's MAX30102 sensor driver. This vulnerability allows a local user to cause a Denial of Service DoS through a system crash. The issue occurs when a device interrupt is triggered while no data buffer is active, causing the interrupt handler to access uninitialize...

CVE-2026-98660

A flaw was found in the Linux kernel's BMP280 pressure sensor driver. An incorrect table boundary calculation during sampling frequency configuration allows an out-of-bounds memory read. A local user with permissions to configure device settings can exploit this flaw to cause a system crash,...

CVE-2026-98659

A flaw was found in the Linux kernel's ROHM BM1390 Industrial I/O IIO sensor driver. The driver fails to propagate error status codes when a read operation fails, unconditionally returning success. A local user querying the sensor can receive invalid or uninitialized measurement data without an...

CVE-2026-98657

A flaw was found in the Linux kernel's PulsedLight LIDAR sensor driver. When device initialization fails during power management setup, the driver fails to properly unregister the device before releasing its allocated memory. This leaves active system interfaces pointing to released memory,...

CVE-2026-78116

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In datareadyworkhandler drivers/sensor/broadcom/afbrs50/afbrs50.c, a non-STATUSOK return from ArgusEvaluateData calls handleerroronresult, which finalises the request with...

CVE-2026-78116 Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In datareadyworkhandler drivers/sensor/broadcom/afbrs50/afbrs50.c, a non-STATUSOK return from ArgusEvaluateData calls handleerroronresult, which finalises the request with...

CVE-2026-78116

The Broadcom AFBR-S50 time-of-flight sensor driver contains a double-free vulnerability in the data_ready_work_handler() function (located in drivers/sensor/broadcom/afbr_s50/afbr_s50.c). When Argus_EvaluateData() returns a non-STATUS_OK value, the code calls handle_error_on_result(), which final...

EUVD-2026-107482

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In datareadyworkhandler drivers/sensor/broadcom/afbrs50/afbrs50.c, a non-STATUSOK return from ArgusEvaluateData calls handleerroronresult, which finalises the request with...

CVE-2026-78116 Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In datareadyworkhandler drivers/sensor/broadcom/afbrs50/afbrs50.c, a non-STATUSOK return from ArgusEvaluateData calls handleerroronresult, which finalises the request with...

CVE-2026-89933

A flaw was found in the Linux kernel's dps310 pressure sensor driver. When a device is enumerated using its ACPI Hardware ID HID, the driver may attempt to dereference a null pointer. This occurs because the ACPI-derived client name does not match the driver's device ID table, causing a critical...

PT-2026-120775

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data ready work handler drivers/sensor/broadcom/afbr s50/afbr s50.c, a non-STATUS OK return from Argus EvaluateData calls handle error on result, which finalises the reques...

PT-2026-94597

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the gp2ap002 light sensor driver where the IIO core fails to filter duplicate writes to the event enable attribute. This causes the write event config function to be...

PT-2026-93578

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the chemical sensor driver for sgp30 where the sgp probe function fails to properly handle errors during the creation of the IAQ thread. Specifically, the kthread run...

PT-2026-93579

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the atlas-sensor driver within the industrial I/O IIO chemical subsystem. The driver uses devm request threaded irq to request hardware data-ready...

CVE-2026-68205

The CVE-2026-68205 details a Linux kernel issue in media: v4l2-fwnode where v4l2_async_register_subdev_sensor() could overwrite the sensor driver’s owner with NULL due to THIS_MODULE resolving to the v4l2-fwnode module (or NULL when built-in). This prevented the sensor module’s reference count fr...

EUVD-2026-55306

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2asyncregistersubdevsensor The v4l2 helper v4l2asyncregistersubdevsensor calls v4l2asyncregistersubdev, which is a macro that expands to v4l2asyncregistersubdevsd,THISMODULE...