CVE-2026-63931

The CVE-2026-63931 vulnerability in the Linux kernel’s iio: chemical (scd30) driver was resolved by adding a zero check for val2 before using it as a divisor when setting the sampling_frequency sysfs attribute. Previously, a user writing a zero fractional part to sampling_frequency could trigger ...

CVE-2026-63930

CVE-2026-63930 — Linux kernel iio: buffer: hw-consumer : The use-after-free occurs in the err_put_buffers cleanup path of iio_hw_consumer_alloc(), where the code used list_for_each_entry() to call iio_buffer_put() on each buffer. If a buffer’s refcount dropped to 0, iio_buffer_put() could free th...

EUVD-2026-45704

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: fix division by zero in writeraw Add a zero check for val2 before using it as a divisor when setting the sampling frequency. A user writing a zero fractional part to the samplingfrequency sysfs attribute...

CVE-2026-63930

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the errputbuffers cleanup path of iiohwconsumeralloc, the code was using listforeachentry to iterate through buffers while calling iiobufferput which can free the...

CVE-2026-63929 iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix DMA fence leak in iiobufferenqueuedmabuf iiobufferenqueuedmabuf allocates a struct iiodmafence 104 bytes, kmalloc-128 via kmallocobj+dmafenceinit, which sets the initial kref to 1. It then calls dmaresvaddfence...

CVE-2026-63929 iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix DMA fence leak in iiobufferenqueuedmabuf iiobufferenqueuedmabuf allocates a struct iiodmafence 104 bytes, kmalloc-128 via kmallocobj+dmafenceinit, which sets the initial kref to 1. It then calls dmaresvaddfence...

EUVD-2026-45702

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix DMA fence leak in iiobufferenqueuedmabuf iiobufferenqueuedmabuf allocates a struct iiodmafence 104 bytes, kmalloc-128 via kmallocobj+dmafenceinit, which sets the initial kref to 1. It then calls dmaresvaddfence...

CVE-2026-53386

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: add bounds check to pgasettings index ads1298pgasettings has 7 elements but ADS1298MASKCHPGA can yield values 0-7. If it yields a value = 7, this causes an out-of-bounds array access. Add a bounds check and...

CVE-2026-53387 iio: light: veml6075: add bounds check to veml6075_it_ms index

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bounds check to veml6075itms index veml6075itms has 5 elements but VEML6075CONFIT can yield values 0-7. If it returns a value = 5, this causes an out-of-bounds array access. Add a bounds check and return...

CVE-2026-53387 iio: light: veml6075: add bounds check to veml6075_it_ms index

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bounds check to veml6075itms index veml6075itms has 5 elements but VEML6075CONFIT can yield values 0-7. If it returns a value = 5, this causes an out-of-bounds array access. Add a bounds check and return...

CVE-2026-53386

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: add bounds check to pgasettings index ads1298pgasettings has 7 elements but ADS1298MASKCHPGA can yield values 0-7. If it yields a value = 7, this causes an out-of-bounds array access. Add a bounds check and...

EUVD-2026-45508

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: add bounds check to pgasettings index ads1298pgasettings has 7 elements but ADS1298MASKCHPGA can yield values 0-7. If it yields a value = 7, this causes an out-of-bounds array access. Add a bounds check and...

CVE-2026-53386

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: add bounds check to pgasettings index ads1298pgasettings has 7 elements but ADS1298MASKCHPGA can yield values 0-7. If it yields a value = 7, this causes an out-of-bounds array access. Add a bounds check and...

CVE-2026-53387

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bounds check to veml6075itms index veml6075itms has 5 elements but VEML6075CONFIT can yield values 0-7. If it returns a value = 5, this causes an out-of-bounds array access. Add a bounds check and return...

CVE-2026-53387

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bounds check to veml6075itms index veml6075itms has 5 elements but VEML6075CONFIT can yield values 0-7. If it returns a value = 5, this causes an out-of-bounds array access. Add a bounds check and return...

PT-2026-61283

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack leak occurs in the adis16550 trigger handler function. The function declares a scan data array on the stack without initializing it. While memcpy fills the first 28 bytes and iio...

PT-2026-61284

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack leak exists in the tagged FIFO buffer of the st lsm6dsx IMU driver. The iio buff structure is declared on the stack with alignment but without an initializer. Due to a hole in th...

PT-2026-61251

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the itg3200 read all channels function where an incorrect memory address is used during an I2C read operation. The function incorrectly uses the address of the local...

PT-2026-61252

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A division by zero occurs in the write raw function of the nxp-sar-adc driver when a user writes a zero or negative value to the sampling frequency sysfs attribute. Additionally, an...

PT-2026-61092

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds array access occurs in the veml6075 it ms index. The veml6075 it ms array contains 5 elements, but the VEML6075 CONF IT register can return values ranging from 0 to 7. I...