Executive brief
A vulnerability was identified in the Linux kernel's driver for the Winsen MHZ19B CO2 sensor. This sensor is typically used in industrial or environmental monitoring systems. An attacker with the ability to send malformed serial data to the device could cause a system crash or memory corruption, potentially disrupting sensor operations or compromising the host system.
Technical details
A buffer overflow exists in the mhz19b_receive_buf() function within drivers/iio/chemical/mhz19b.c. The driver appends incoming serdev chunks into a fixed-size receive buffer (MHZ19B_CMD_SIZE) without verifying if the incoming data length exceeds the remaining buffer space. This allows a large serial callback to overflow the 'st->buf' structure. The fix introduces bounds checking, resets the reply state before each command, and rejects oversized replies with -EMSGSIZE. This vulnerability is reachable via the serial interface connected to the MHZ19B sensor.
Affected products
- Linux Linux Kernel 6.16 to 6.18.35, 7.0 to 7.0.12
Timeline
- 2026-04-02: other: Patch authored
- 2026-07-19: disclosed: CVE published