CVE-2026-98680

A flaw was found in the Linux kernel's Kionix KX022A accelerometer sensor driver. When enabling the device buffer fails during register configuration, the driver fails to properly free allocated memory or restore previous hardware states. A local user could trigger this error condition to cause a...

CVE-2026-98661

A flaw was found in the Linux kernel's ROHM BU27034 ambient light sensor driver. When reading the sensor integration time fails, the driver improperly uses the returned error code to calculate sleep duration. A local user interacting with the sensor interface during a read failure can cause the...

CVE-2026-98665

A flaw was found in the Linux kernel's MAX30102 sensor driver. This vulnerability allows a local user to cause a Denial of Service DoS through a system crash. The issue occurs when a device interrupt is triggered while no data buffer is active, causing the interrupt handler to access uninitialize...

CVE-2026-98660

A flaw was found in the Linux kernel's BMP280 pressure sensor driver. An incorrect table boundary calculation during sampling frequency configuration allows an out-of-bounds memory read. A local user with permissions to configure device settings can exploit this flaw to cause a system crash,...

CVE-2026-98659

A flaw was found in the Linux kernel's ROHM BM1390 Industrial I/O IIO sensor driver. The driver fails to propagate error status codes when a read operation fails, unconditionally returning success. A local user querying the sensor can receive invalid or uninitialized measurement data without an...

CVE-2026-98657

A flaw was found in the Linux kernel's PulsedLight LIDAR sensor driver. When device initialization fails during power management setup, the driver fails to properly unregister the device before releasing its allocated memory. This leaves active system interfaces pointing to released memory,...

CVE-2026-78116

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In datareadyworkhandler drivers/sensor/broadcom/afbrs50/afbrs50.c, a non-STATUSOK return from ArgusEvaluateData calls handleerroronresult, which finalises the request with...

CVE-2026-78116

The Broadcom AFBR-S50 time-of-flight sensor driver contains a double-free vulnerability in the data_ready_work_handler() function (located in drivers/sensor/broadcom/afbr_s50/afbr_s50.c). When Argus_EvaluateData() returns a non-STATUS_OK value, the code calls handle_error_on_result(), which final...

CVE-2026-78116 Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In datareadyworkhandler drivers/sensor/broadcom/afbrs50/afbrs50.c, a non-STATUSOK return from ArgusEvaluateData calls handleerroronresult, which finalises the request with...

CVE-2026-78116 Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In datareadyworkhandler drivers/sensor/broadcom/afbrs50/afbrs50.c, a non-STATUSOK return from ArgusEvaluateData calls handleerroronresult, which finalises the request with...

CVE-2026-89933

A flaw was found in the Linux kernel's dps310 pressure sensor driver. When a device is enumerated using its ACPI Hardware ID HID, the driver may attempt to dereference a null pointer. This occurs because the ACPI-derived client name does not match the driver's device ID table, causing a critical...

PT-2026-94597

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the gp2ap002 light sensor driver where the IIO core fails to filter duplicate writes to the event enable attribute. This causes the write event config function to be...

PT-2026-93579

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the atlas-sensor driver within the industrial I/O IIO chemical subsystem. The driver uses devm request threaded irq to request hardware data-ready...

PT-2026-93578

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the chemical sensor driver for sgp30 where the sgp probe function fails to properly handle errors during the creation of the IAQ thread. Specifically, the kthread run...

CVE-2026-68205

The CVE-2026-68205 details a Linux kernel issue in media: v4l2-fwnode where v4l2_async_register_subdev_sensor() could overwrite the sensor driver’s owner with NULL due to THIS_MODULE resolving to the v4l2-fwnode module (or NULL when built-in). This prevented the sensor module’s reference count fr...

EUVD-2026-55306

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2asyncregistersubdevsensor The v4l2 helper v4l2asyncregistersubdevsensor calls v4l2asyncregistersubdev, which is a macro that expands to v4l2asyncregistersubdevsd,THISMODULE...

UBUNTU-CVE-2026-64494

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002readraw calls pmruntimegetsync before reading the lux value, but if gp2ap002getlux fails, it returns directly. This skips the pmruntimeputautosuspend call at the "ou...

UBUNTU-CVE-2026-43476

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: sps30i2c: fix buffer size in sps30i2creadmeas sizeofnum evaluates to sizeofsizet 8 bytes on 64-bit instead of the intended be32 element size 4 bytes. Use sizeofmeas to correctly match the buffer element type...

CVE-2026-43356

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis: Fix NULL pointer dereference in adisinit The adisinit function dereferences adis-ops to check if the individual function pointers write, read, reset are NULL, but does not first check if adis-ops itself is NULL...

Linux kernel sensor driver module Heap Buffer Overflow DoS

The vulnerability of the cm3605probe function in the drivers/iio/light/cm3605.c file of the Linux kernel’s sensor driver module is related to a memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...