CVE-2026-98660: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-98660 Overview

CVE-2026-98660 is an out-of-bounds access vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem, specifically within the bmp280 pressure sensor driver. The flaw resides in bmp280_write_sampling_frequency(), which indexes a sampling frequency table using an incorrect element count. The table stores each frequency as an integer part and a fractional part in micro units, but num_sampling_freq_avail holds the flattened integer element count rather than the number of rows. Iterating over this count as if it were a row count causes reads past the end of the table.

Critical Impact
Out-of-bounds access in a kernel driver can lead to memory corruption, information disclosure, or kernel instability when userspace writes a sampling frequency to the affected sysfs attribute.

Affected Products

Linux kernel IIO subsystem
drivers/iio/pressure/bmp280 driver
Systems using Bosch BMP280 and related pressure sensors through this driver

Discovery Timeline

2026-10-18 - CVE-2026-98660 published to the National Vulnerability Database
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98660

Vulnerability Analysis

The bmp280 driver exposes available sampling frequencies through the IIO read_avail() interface. That interface returns frequencies as a flat array where each entry occupies two integers: an integer portion and a fractional portion expressed in micro units. The counter num_sampling_freq_avail is initialized to the total number of flat integer elements in the table.

A separate code path, bmp280_write_sampling_frequency(), treats the same table as a two-dimensional array of [integer, micro] rows. It uses num_sampling_freq_avail as the row count during iteration. Because the flat count is twice the actual row count, the loop walks past the end of the backing array.

The upstream fix converts the flattened element count back to the number of rows before iterating. This is an Out-of-Bounds Read condition triggered through a legitimate sysfs write path.

Root Cause

The root cause is an inconsistent interpretation of a shared data structure. The producer side (read_avail()) flattens pairs into a 1-D array and sets the count accordingly. The consumer side (bmp280_write_sampling_frequency()) treats the same count as a row count for 2-D iteration. The dimensional mismatch doubles the effective iteration range.

Attack Vector

Exploitation requires local access to write to the sampling_frequency IIO sysfs attribute of a bmp280-backed device. On systems where this attribute is writable by unprivileged users or by processes with access to the IIO device node, a crafted write triggers the out-of-bounds read in kernel context. The impact depends on kernel configuration, allocator layout, and whether hardening features such as KASAN or FORTIFY_SOURCE are active.

No verified public exploit code is available. See the upstream commits referenced below for the exact patch logic: Kernel Git Commit 05ef1af, Kernel Git Commit 4fd5a61, Kernel Git Commit 56c423b, Kernel Git Commit 7dbb518, and Kernel Git Commit 9db6684.

Detection Methods for CVE-2026-98660

Indicators of Compromise

Kernel log entries referencing bmp280_write_sampling_frequency with KASAN or slab-out-of-bounds warnings.
Unexpected kernel oops or BUG: messages generated after writes to IIO sampling_frequency attributes under /sys/bus/iio/devices/.
Repeated userspace writes to the sampling frequency attribute from processes that do not normally interact with IIO sensors.

Detection Strategies

Enable KASAN on test or canary systems that expose the bmp280 driver to detect the out-of-bounds read at runtime.
Monitor kernel version strings across the fleet and flag hosts running pre-patch kernels that load bmp280_i2c, bmp280_spi, or related modules.
Audit which users and services hold write access to IIO sysfs attributes on affected devices.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log entries containing bmp280, KASAN, or out-of-bounds to a centralized logging pipeline for correlation.
Track sysfs writes to IIO device paths through Linux audit (auditctl -w /sys/bus/iio/devices/ -p wa) on sensitive systems.
Inventory embedded and edge devices that integrate BMP280 or compatible pressure sensors and verify kernel patch status.

How to Mitigate CVE-2026-98660

Immediate Actions Required

Update affected systems to a Linux kernel version that includes the upstream fix for bmp280_write_sampling_frequency().
Restrict write permissions on IIO sysfs attributes to privileged service accounts only.
Unload the bmp280 driver on systems that do not require pressure sensor functionality until patches are applied.

Patch Information

The fix converts the flattened element count back to the number of rows before iterating over the sampling frequency table. The upstream commits are available at Kernel Git Commit 05ef1af, Kernel Git Commit 4fd5a61, Kernel Git Commit 56c423b, Kernel Git Commit 7dbb518, and Kernel Git Commit 9db6684. Apply the backport that matches your stable branch and rebuild affected kernels.

Workarounds

Blacklist the bmp280, bmp280_i2c, and bmp280_spi modules on systems where the sensor is not required.
Tighten udev rules so that sampling_frequency attributes under /sys/bus/iio/devices/iio:deviceN/ are not writable by non-root users.
Avoid exposing IIO sensor control to untrusted containers or workloads until the patched kernel is deployed.

bash

# Example: blacklist the bmp280 modules until patched kernels are deployed
echo 'blacklist bmp280' | sudo tee /etc/modprobe.d/bmp280-cve-2026-98660.conf
echo 'blacklist bmp280_i2c' | sudo tee -a /etc/modprobe.d/bmp280-cve-2026-98660.conf
echo 'blacklist bmp280_spi' | sudo tee -a /etc/modprobe.d/bmp280-cve-2026-98660.conf
sudo update-initramfs -u

# Restrict write access to IIO sampling_frequency attributes
sudo find /sys/bus/iio/devices -name sampling_frequency -exec chmod 0600 {} \;