CVE-2026-64504

A flaw was found in the Linux kernel's bmc150 accelerometer driver. A malicious or malfunctioning accelerometer device, or an attacker tampering with the I2C/SPI bus, can report an excessively large number of FIFO frames. This improper handling of the frame count leads to a stack out-of-bounds...

CVE-2026-64503

A flaw was found in the Linux kernel's iio subsystem, specifically in the kxsd9 accelerometer driver. A local user could exploit this by requesting a scale with a non-zero integer part through the kxsd9writeraw function. This action causes a runtime Power Management PM usage-counter reference to...

SUSE CVE-2026-64503

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on writeraw error kxsd9writeraw takes a runtime PM reference with pmruntimegetsync but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the...

UBUNTU-CVE-2026-64504

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count bmc150accelfifoflush copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 bufferBMC150ACCELFIFOLENGTH 3; which is sized fo...

UBUNTU-CVE-2026-64503

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on writeraw error kxsd9writeraw takes a runtime PM reference with pmruntimegetsync but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the...

CVE-2026-64503

CVE-2026-64503 – Linux kernel (iio: accel: kxsd9) The vulnerability arises in kxsd9_write_raw() which calls pm_runtime_get_sync() but returns -EINVAL when a non-zero integer part is requested. This path skips the corresponding pm_runtime_put_autosuspend(), leaking a runtime PM usage-counter and p...

CVE-2026-64503

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on writeraw error kxsd9writeraw takes a runtime PM reference with pmruntimegetsync but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the...

EUVD-2026-48848

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count bmc150accelfifoflush copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 bufferBMC150ACCELFIFOLENGTH 3; which is sized fo...

CVE-2026-64504 iio: accel: bmc150: clamp the device-reported FIFO frame count

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count bmc150accelfifoflush copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 bufferBMC150ACCELFIFOLENGTH 3; which is sized fo...

CVE-2026-64504

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count bmc150accelfifoflush copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 bufferBMC150ACCELFIFOLENGTH 3; which is sized fo...

CVE-2026-64503 iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on writeraw error kxsd9writeraw takes a runtime PM reference with pmruntimegetsync but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the...

PT-2026-64725

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count bmc150 accel fifo flush copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 bufferBMC150 ACCEL FIFO LENGTH 3; which is...

PT-2026-64724

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on write raw error kxsd9 write raw takes a runtime PM reference with pm runtime get sync but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping th...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: Fixed an issue with the irq assumption regression. The code in bmc150-accel-core.c unconditionally calls bmc150accelsetinterrupt in the iiobuffersetupops. This occurs, for example, during the runtime PM resume...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: use the correct logic to get mma8452data. The original logic for getting mma8452data is incorrect. The dev points to the device belonging to iiodev. We cannot use this dev to find the correct i2cclient. The...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iio: imu: stlsm6dsx: Set buffer sampling frequency for accelerometer only The stlsm6dsxhwfifoodrstore function, which is called when the user space writes the buffer sampling frequency sysfs attribute, calls stlsm6dsxcheckodr. Th...

CVE-2026-43307

A flaw was found in the Linux kernel's iio: accel: adxl380 driver. The driver's interrupt handler, responsible for reading data from the sensor's FIFO First-In, First-Out buffer, can miscalculate the number of entries. This error may cause the driver to attempt to read beyond the actual data...

EUVD-2026-28577

In the Linux kernel, the following vulnerability has been resolved: iio: accel: adxl380: Avoid reading more entries than present in FIFO The interrupt handler reads FIFO entries in batches of N samples, where N is the number of scan elements that have been enabled. However, the sensor fills the...

CVE-2026-43307

In the Linux kernel, the following vulnerability has been resolved: iio: accel: adxl380: Avoid reading more entries than present in FIFO The interrupt handler reads FIFO entries in batches of N samples, where N is the number of scan elements that have been enabled. However, the sensor fills the...

CVE-2026-43307

The CVE concerns the Linux kernel iio: accel: adxl380 driver. The interrupt handler can miscalculate FIFO entries because the sensor fills FIFO one sample at a time while batches are read, causing the FIFO status to report a non-multiple of N. This can cause the driver to read more entries than p...