CVE-2026-98661 Overview
CVE-2026-98661 is a Linux kernel vulnerability in the rohm-bu27034 ambient light sensor driver under the Industrial I/O (IIO) subsystem. When the driver attempts to read the integration time and the read operation fails, it propagates the negative error code into a sleep calculation. This leads to an improper delay computation that can stall driver execution.
The maintainers resolved the issue by substituting the smallest valid integration time as a default whenever the read fails, preventing the error code from being misinterpreted as a time value.
Critical Impact
A local error condition in the ROHM BU27034 light sensor driver causes the kernel to compute delays from an error code, resulting in prolonged or indefinite waits during I/O operations.
Affected Products
- Linux kernel versions containing the drivers/iio/light/rohm-bu27034.c driver prior to the fix
- Systems using the ROHM BU27034 ambient light sensor via the IIO subsystem
- Downstream Linux distributions shipping affected stable kernel branches
Discovery Timeline
- 2026-10-18 - CVE-2026-98661 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98661
Vulnerability Analysis
The rohm-bu27034 driver supports the ROHM BU27034 ambient light sensor exposed through the Linux IIO subsystem. During normal operation, the driver reads the configured integration time to determine how long to wait before sampling data. The returned integration time value is passed into a sleep routine.
When the register read fails, the driver returns a negative errno value instead of a valid integration time. Without validation, this negative value is converted and used as the sleep duration. Depending on type coercion, the resulting delay becomes either very large or effectively infinite, blocking the calling thread.
This is a reliability defect in a kernel driver rather than a remotely exploitable flaw. The impact is limited to systems with the BU27034 sensor present and active.
Root Cause
The root cause is missing error-return validation after reading the integration time. The code path assumed the read would always succeed and did not sanitize the value before using it to compute a sleep interval. This maps to improper input validation on an internal API return value.
Attack Vector
Triggering the defect requires the sensor to produce a read failure on the integration-time register. A local user interacting with the IIO sysfs interface, or a transient hardware fault on the I2C bus, can cause the condition. There is no known network-reachable attack surface. The practical outcome is a denial-of-service style stall of the driver thread rather than code execution or privilege escalation.
See the upstream fix at Linux Kernel Commit 050482f and the related stable backports at Commit 10a958e, Commit 6a27402, and Commit 8065a6c.
Detection Methods for CVE-2026-98661
Indicators of Compromise
- Processes blocked for unusually long periods in D (uninterruptible sleep) state while interacting with IIO light sensor sysfs entries under /sys/bus/iio/devices/.
- Kernel log entries referencing read failures or I2C communication errors associated with the rohm-bu27034 driver.
- User-space applications performing ambient light reads that hang or time out without returning data.
Detection Strategies
- Enumerate loaded kernel modules and compare the running kernel version against vendor advisories listing the rohm-bu27034 fix commits.
- Monitor dmesg and journal output for I2C transfer errors on buses hosting the BU27034 sensor.
- Audit systems with ambient light sensors to confirm whether the BU27034 driver is present and in use.
Monitoring Recommendations
- Collect kernel version and loaded module inventory from Linux endpoints into a centralized data lake for drift detection.
- Alert on repeated task hangs or soft lockup warnings tied to IIO driver threads.
- Track patch deployment status for stable kernel branches referenced in the upstream commits.
How to Mitigate CVE-2026-98661
Immediate Actions Required
- Apply the upstream Linux kernel patch that defaults to the smallest integration time when the read fails.
- Update to a stable kernel release that includes the backported fix for the rohm-bu27034 driver.
- Inventory systems using the ROHM BU27034 sensor and prioritize those running affected kernel versions.
Patch Information
The fix is available in upstream Linux stable trees. Review Linux Kernel Commit 050482f for the mainline change and the stable backports at Commit 10a958e, Commit 6a27402, and Commit 8065a6c. Rebuild and redeploy affected kernels, then validate sensor reads return promptly.
Workarounds
- Unload the rohm-bu27034 module on systems that do not require ambient light sensing until the patched kernel is deployed.
- Restrict access to IIO sysfs attributes for the affected device to privileged users only.
- Where feasible, disable the sensor at the device tree or ACPI level to avoid driver binding on unpatched kernels.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
