In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table… (CVE-2026-64495)
Source GCVE Database
Not known to be exploited : update affected systems when convenient.
Data as of 10/24/2026, 17:08:26 UTC
No CVSS score from NVD or the CNA
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 8% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been implemented in the Linux kernel to return an error (-EINVAL) when no matching bandwidth/filter entry is found, preventing the out-of-bounds read. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. Patch status is not explicitly confirmed here; check the vendor or kernel mailing list advisories for the exact fixed version.
Description
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip: for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) { if (bmg160_samp_freq_table[i].bw_bits == bw_bits) break; } *val = bmg160_samp_freq_table[i].filter; If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160_set_filter() has the same shape, driven by 'val' instead of bw_bits. smatch flags both: drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error: buffer overflow 'bmg160_samp_freq_table' 7 <= 7 Return -EINVAL when no entry matches. The set_filter() path is reachable from userspace via the sysfs in_anglvel_filter_low_pass_3db_frequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160_samp_freq_table[].filter.
Impact
An out-of-bounds read vulnerability in the kernel driver can lead to undefined behavior, potentially causing system instability or information disclosure. Since the vulnerable code is reachable from userspace via a sysfs interface, a local user can trigger this condition. There is no indication of known exploits in the wild. The impact is limited to local users with access to the sysfs interface for the bmg160 gyro sensor driver.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64495 (opens in a new tab)
- git.kernel.org/stable/c/029481cddb98697716f4bf3021d035eaf2ca0e1f (opens in a new tab)
- git.kernel.org/stable/c/1dc3a833be11e5d503038e3c701745fd0e03903c (opens in a new tab)
- git.kernel.org/stable/c/6c8675468862161d1c59130266852b66867d3861 (opens in a new tab)
- git.kernel.org/stable/c/77e56ebb1786f4296afd5fa46975a989b285ae65 (opens in a new tab)
- git.kernel.org/stable/c/7bbf02b63961fc1768c9c654392c11f2077d4c59 (opens in a new tab)
- git.kernel.org/stable/c/8320c77e67382d5d55d77043a5f60a867d408a2b (opens in a new tab)
- git.kernel.org/stable/c/8d202515baea4e2e3be448d1590099af28f2346d (opens in a new tab)
- git.kernel.org/stable/c/d85ee50f58dd83fe74f6d0bf8bd345c657b216e8 (opens in a new tab)