CVE-2026-64495: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64495 Overview

CVE-2026-64495 is an out-of-bounds read vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the Bosch BMG160 gyroscope driver (drivers/iio/gyro/bmg160_core.c). The flaw resides in the bmg160_get_filter() and bmg160_set_filter() functions, which iterate over bmg160_samp_freq_table[] without validating that a matching entry was found. When no entry matches, the loop index equals the array size, and the code reads one slot past the end of the array. The set_filter() path is reachable from userspace through the in_anglvel_filter_low_pass_3db_frequency sysfs interface, allowing local users to trigger the out-of-bounds access.

Critical Impact
Local users with access to the affected sysfs interface can trigger an out-of-bounds read in kernel memory, potentially leading to information disclosure or kernel instability on systems with a BMG160 gyroscope.

Affected Products

Linux kernel — drivers/iio/gyro/bmg160_core.c
Systems using the Bosch BMG160 gyroscope with the IIO driver enabled
Multiple stable kernel branches (fixed via backports referenced in the kernel.org commits)

Discovery Timeline

2026-07-25 - CVE-2026-64495 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64495

Vulnerability Analysis

The vulnerability affects the BMG160 gyroscope driver in the Linux kernel's IIO subsystem. Both bmg160_get_filter() and bmg160_set_filter() walk bmg160_samp_freq_table[] searching for an entry that matches either the bw_bits value read from the device or a val supplied by userspace. The loop uses a standard for iterator, but neither function checks whether the loop terminated because a match was found or because the array was exhausted.

When no matching entry exists, the loop variable i equals ARRAY_SIZE(bmg160_samp_freq_table). The subsequent dereference bmg160_samp_freq_table[i].filter then reads memory immediately past the end of the array. The static analyzer smatch flagged both call sites with the diagnostic buffer overflow 'bmg160_samp_freq_table' 7 <= 7.

Because bmg160_set_filter() is invoked through the in_anglvel_filter_low_pass_3db_frequency sysfs attribute, a local user can supply any integer value and trigger the read of adjacent kernel memory. The fix returns -EINVAL when no table entry matches the requested value.

Root Cause

The root cause is missing bounds validation after a linear table search. The driver assumes every value read from hardware or written from userspace corresponds to an entry in bmg160_samp_freq_table[], but neither assumption holds. This is a classic out-of-bounds read pattern where a loop index is reused as an array subscript without verifying that the search succeeded.

Attack Vector

The attack requires local access to a Linux system that has loaded the bmg160 driver against a physical or emulated BMG160 gyroscope. An attacker with permission to write to the in_anglvel_filter_low_pass_3db_frequency sysfs file writes a value that is not present in bmg160_samp_freq_table[].filter. This causes bmg160_set_filter() to read one slot past the end of the table. Impact is limited to information disclosure of adjacent kernel memory and potential driver instability. See the kernel commit 8320c77 for the mainline fix.

Detection Methods for CVE-2026-64495

Indicators of Compromise

Unexpected writes to /sys/bus/iio/devices/iio:deviceN/in_anglvel_filter_low_pass_3db_frequency from non-administrative users or unusual processes.
Kernel log entries referencing bmg160 driver errors, unexpected -EINVAL returns, or KASAN reports flagging out-of-bounds reads in bmg160_get_filter or bmg160_set_filter.
Sudden instability or unexpected values reported by the gyroscope after userspace filter configuration attempts.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test or pre-production kernels to catch the out-of-bounds read at runtime with a full stack trace.
Run the smatch static analyzer against the IIO subsystem to identify similar unbounded linear-search patterns in other drivers.
Audit process activity for unauthorized writes to IIO sysfs attributes, particularly on systems where sensor configuration is normally static.

Monitoring Recommendations

Forward kernel ring buffer messages (dmesg, /var/log/kern.log) to a centralized log platform and alert on bmg160 and KASAN diagnostics.
Track file access on /sys/bus/iio/devices/ using audit rules (auditctl -w /sys/bus/iio/ -p wa) to detect unexpected configuration writes.
Inventory kernel versions across the fleet and flag hosts running unpatched builds that also expose the BMG160 driver.

How to Mitigate CVE-2026-64495

Immediate Actions Required

Apply the upstream kernel patches from kernel.org to any distribution kernel that includes the bmg160 IIO driver.
On systems that do not use a BMG160 gyroscope, blacklist the bmg160_core, bmg160_i2c, and bmg160_spi modules to remove the attack surface entirely.
Restrict write permissions on /sys/bus/iio/devices/*/in_anglvel_filter_low_pass_3db_frequency to trusted administrative accounts.

Patch Information

The fix adds a check so that bmg160_get_filter() and bmg160_set_filter() return -EINVAL when no matching entry exists in bmg160_samp_freq_table[]. Backports are available across multiple stable branches. See the mainline and stable commits: 029481c, 1dc3a83, 6c86754, 77e56eb, 7bbf02b, 8320c77, 8d20251, and d85ee50.

Workarounds

Unload the bmg160 modules with modprobe -r bmg160_i2c bmg160_spi bmg160_core on hosts that do not require gyroscope functionality.
Add blacklist bmg160_core to /etc/modprobe.d/ to prevent the driver from loading on boot.
Use filesystem permissions or udev rules to remove write access to the affected sysfs attribute for non-root users.

bash

# Configuration example: prevent the vulnerable driver from loading
echo "blacklist bmg160_core" | sudo tee /etc/modprobe.d/blacklist-bmg160.conf
echo "blacklist bmg160_i2c"  | sudo tee -a /etc/modprobe.d/blacklist-bmg160.conf
echo "blacklist bmg160_spi"  | sudo tee -a /etc/modprobe.d/blacklist-bmg160.conf
sudo modprobe -r bmg160_i2c bmg160_spi bmg160_core 2>/dev/null || true

# Restrict write access to the affected sysfs attribute
for f in /sys/bus/iio/devices/*/in_anglvel_filter_low_pass_3db_frequency; do
    [ -e "$f" ] && sudo chmod 600 "$f"
done