Executive brief
A vulnerability in the Linux kernel's proximity sensor driver could allow a local user to cause a system crash. The issue occurs when the system attempts to process an unspecified sampling frequency for the HX9023S sensor, leading to a mathematical error. This primarily impacts system availability and could disrupt operations on devices using this specific hardware.
Technical details
A division-by-zero vulnerability exists in the hx9023s proximity sensor driver within the Linux kernel's Industrial I/O (IIO) subsystem. The root cause is located in the `hx9023s_set_samp_freq` function, where the code fails to validate that the sampling frequency parameters (`val` and `val2`) are non-zero before performing a division operation using `div_u64`. An attacker with local access could potentially trigger this condition to cause a kernel oops or panic, resulting in a denial of service. The issue has been resolved by adding a check to return `-EINVAL` if both frequency parameters are zero. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux Kernel hx9023s driver versions prior to the 2026-03 patches
Timeline
- 2026-02-13: other: Vulnerability fixed in source code by Yasin Lee
- 2026-05-08: disclosed: CVE-2026-43354 published