CVE-2026-31764: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31764 Overview

CVE-2026-31764 is an out-of-bounds array access vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the STMicroelectronics st_lsm6dsx inertial measurement unit (IMU) driver. The flaw resides in the st_lsm6dsx_hwfifo_odr_store() function, which handles userspace writes to the buffer sampling frequency sysfs attribute. When invoked, the function calls st_lsm6dsx_check_odr(), which indexes the odr_table array using sensor->id. The array contains only two entries, so any sensor type other than the accelerometer or gyroscope triggers an out-of-bounds read.

Critical Impact

Local userspace processes with access to the IIO sysfs interface can trigger out-of-bounds memory access in the kernel, potentially leading to information disclosure or kernel instability.

Affected Products

• Linux kernel versions containing the st_lsm6dsx IIO IMU driver prior to the upstream fix
• Systems using STMicroelectronics LSM6DSx-family IMU sensors via the IIO subsystem
• Distributions that have not yet backported commits 3225a81e8d26 or 679c04c10d65

Discovery Timeline

• 2026-05-01 - CVE-2026-31764 published to NVD
• 2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-31764

Vulnerability Analysis

The st_lsm6dsx driver supports the LSM6DSx family of inertial sensors, which expose multiple sensor types through the IIO subsystem. Userspace can configure each sensor's hardware FIFO output data rate (ODR) by writing to a sysfs attribute. That write path enters st_lsm6dsx_hwfifo_odr_store() and ultimately reaches st_lsm6dsx_check_odr().

Inside st_lsm6dsx_check_odr(), the driver dereferences odr_table[sensor->id]. The odr_table is sized for two sensor IDs corresponding to the accelerometer and gyroscope. However, the driver registers additional sensor types beyond those two, and the buffer sampling frequency attribute was created for all of them. When a non-accelerometer, non-gyroscope sensor reaches this code path, the indexed read falls outside the array bounds.

The upstream fix removes creation of the buffer sampling frequency attribute for sensor types other than the accelerometer. All supported event types are derived from acceleration data, so the attribute is unnecessary for other sensors.

Root Cause

The root cause is an out-of-bounds read [CWE-125] caused by missing validation of sensor->id before it is used as an index into a fixed-size array. The driver assumed every sensor exposing the FIFO ODR attribute had a matching entry in odr_table, but that invariant did not hold for non-IMU sensor types registered by the same driver.

Attack Vector

Exploitation requires local access and the ability to write to the IIO sysfs attributes, typically restricted to root or members of a privileged group. An attacker with such access writes a value to the hwfifo_sampling_frequency attribute on a non-accelerometer, non-gyroscope sensor exposed by the st_lsm6dsx driver. The write triggers the out-of-bounds access inside st_lsm6dsx_check_odr(), which can leak adjacent kernel memory contents through driver behavior or destabilize the kernel.

The vulnerability is not network-reachable and requires the affected hardware to be present on the system. No public proof-of-concept exploit has been published.

Detection Methods for CVE-2026-31764

Indicators of Compromise

• Unexpected kernel warnings, KASAN reports, or oops messages referencing st_lsm6dsx_check_odr or st_lsm6dsx_hwfifo_odr_store in dmesg or journalctl -k
• Userspace processes writing to /sys/bus/iio/devices/iio:deviceN/buffer/hwfifo_sampling_frequency on non-accelerometer sensors exposed by the st_lsm6dsx driver
• Kernel module crashes or driver disable events affecting LSM6DSx-family sensors

Detection Strategies

• Enable Kernel Address Sanitizer (KASAN) on test and pre-production kernels to surface the out-of-bounds read deterministically during fuzzing of IIO sysfs interfaces.
• Audit installed kernel versions against the fixed commits 3225a81e8d26 and 679c04c10d65 to identify systems still running vulnerable builds.
• Monitor for unprivileged or unexpected user processes interacting with IIO sysfs attributes on devices that ship LSM6DSx hardware.

Monitoring Recommendations

• Forward kernel logs to a centralized logging or SIEM platform and alert on driver-specific oops or KASAN signatures.
• Track package-level kernel versions across the fleet through configuration management to confirm patch coverage.
• Review auditd rules covering writes to /sys/bus/iio/ paths on systems with the affected hardware.

How to Mitigate CVE-2026-31764

Immediate Actions Required

• Apply the upstream Linux kernel patches referenced by commits 3225a81e8d26 and 679c04c10d65 or upgrade to a distribution kernel that includes the fix.
• Restrict write access to IIO sysfs attributes to trusted administrative accounts on systems using LSM6DSx-family sensors.
• Inventory embedded, mobile, and edge devices that use STMicroelectronics IMU sensors and prioritize them for kernel updates.

Patch Information

The fix modifies the st_lsm6dsx driver to create the hwfifo_sampling_frequencysysfs attribute only for the accelerometer sensor. Because all supported event types in this driver are generated from acceleration data, no functional capability is lost for the gyroscope or other sensor types. Apply the patch by updating to a kernel that includes commits 3225a81e8d26 and 679c04c10d65, or backport the changes to long-term support kernels still in use.

Workarounds

• If patching is not immediately possible, unload the st_lsm6dsx kernel module on systems where the affected hardware is not required.
• Use Linux Security Modules such as SELinux or AppArmor to deny write access to hwfifo_sampling_frequency attributes for non-administrative users.
• Set strict filesystem permissions on /sys/bus/iio/devices/*/buffer/ entries through udev rules to prevent unprivileged writes.

# Example udev rule to restrict IIO buffer attribute writes
# /etc/udev/rules.d/99-iio-restrict.rules
SUBSYSTEM=="iio", KERNEL=="iio:device*", \
    ACTION=="add|change", \
    RUN+="/bin/sh -c 'chmod 600 /sys/bus/iio/devices/%k/buffer/hwfifo_sampling_frequency 2>/dev/null || true'"