Executive brief
A vulnerability was identified in the Linux kernel's SCD30 chemical sensor driver. A local user could cause a system crash (denial of service) by providing a specific invalid value to the sensor's sampling frequency setting. This affects systems using this specific hardware sensor and could disrupt operations or lead to a system reboot.
Technical details
A division by zero vulnerability exists in the 'scd30_write_raw' function within 'drivers/iio/chemical/scd30_core.c' of the Linux kernel. The issue occurs when a user writes a zero fractional part to the 'sampling_frequency' sysfs attribute, which is then used as a divisor without proper validation. An attacker with local access to the sysfs interface can trigger this condition to cause a kernel oops or system hang. The fix introduces a check for the 'val2' parameter to ensure it is non-zero before performing the division. Patching is available in various stable kernel branches including 5.10.y, 5.15.y, 6.1.y, and 6.6.y.
Affected products
- Linux Linux Kernel 5.9 to 5.10.259, 5.15.210, 6.1.176, 6.6.143
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/2c50c017df97bfb425038efdfb8514c7bcd08564
- https://git.kernel.org/stable/c/4748bce423a363bb8a85a624faeb8f54fe331611
- https://git.kernel.org/stable/c/5aba4f94b225617a55fed442a70329b2ee19c0a5
- https://git.kernel.org/stable/c/5e4d34092a5ebfbc3a45a180c76ecb1cdbbedd53
- https://git.kernel.org/stable/c/6308b812acdcac38cbfe1af0b1524c3375f408a5
- https://git.kernel.org/stable/c/c7a740bf75554b051fabb17596ca6e483d6e6d90
- https://git.kernel.org/stable/c/d98c2e69aab905d1b19a69ffe584efa46a9efd42