CVE-2026-64495: Linux kernel · iio: gyro: bmg160: bail out when bandwidth/filter is not in table
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 3 Nov 2026, 19:14 UTC
Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or noneExploitation evidence
Disclosed: evidence found.
CVE published 25 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 3 Nov 2026.
What to do
AI-suggested
A fix has been applied in the Linux kernel to return an error (-EINVAL) when no matching bandwidth/filter entry is found, preventing out-of-bounds reads. Users should update to the fixed Linux kernel version once available. No other mitigation is indicated.
Description
A buffer overflow vulnerability exists in the Linux kernel's iio gyro driver for the bmg160 sensor. The functions bmg160_get_filter() and bmg160_set_filter() read beyond the bounds of the bmg160_samp_freq_table array when a bandwidth/filter value not present in the table is provided. This can be triggered from userspace via the sysfs interface in_anglvel_filter_low_pass_3db_frequency.
References
- git.kernel.org/stable/c/1dc3a833be11e5d503038e3c701745fd0e03903c (opens in a new tab)
- git.kernel.org/stable/c/77e56ebb1786f4296afd5fa46975a989b285ae65 (opens in a new tab)
- git.kernel.org/stable/c/029481cddb98697716f4bf3021d035eaf2ca0e1f (opens in a new tab)
- git.kernel.org/stable/c/8d202515baea4e2e3be448d1590099af28f2346d (opens in a new tab)
- git.kernel.org/stable/c/d85ee50f58dd83fe74f6d0bf8bd345c657b216e8 (opens in a new tab)
- git.kernel.org/stable/c/7bbf02b63961fc1768c9c654392c11f2077d4c59 (opens in a new tab)
- git.kernel.org/stable/c/6c8675468862161d1c59130266852b66867d3861 (opens in a new tab)
- git.kernel.org/stable/c/8320c77e67382d5d55d77043a5f60a867d408a2b (opens in a new tab)