Executive brief
A vulnerability in the Linux kernel's BMG160 gyroscope sensor driver could allow a local user to cause a system crash or read sensitive kernel memory. The issue occurs when the system processes specific frequency filter settings through the standard hardware interface. This could impact the stability of devices using this specific motion sensor hardware.
Technical details
An out-of-bounds read vulnerability exists in drivers/iio/gyro/bmg160_core.c within the bmg160_get_filter() and bmg160_set_filter() functions. The code iterates through bmg160_samp_freq_table[] to find a matching entry but fails to validate if a match was actually found before accessing the array index. If no match occurs, the index 'i' equals the array size, leading to a read one slot past the end of the buffer. This path is reachable from userspace via the sysfs 'in_anglvel_filter_low_pass_3db_frequency' interface. The fix introduces a check to return -EINVAL if the loop completes without finding a valid entry.
Affected products
- Linux Linux Kernel 22b46c45fb9b to 1dc3a833be11e5d503038e3c701745fd0e03903c
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
References
- https://git.kernel.org/stable/c/029481cddb98697716f4bf3021d035eaf2ca0e1f
- https://git.kernel.org/stable/c/1dc3a833be11e5d503038e3c701745fd0e03903c
- https://git.kernel.org/stable/c/6c8675468862161d1c59130266852b66867d3861
- https://git.kernel.org/stable/c/77e56ebb1786f4296afd5fa46975a989b285ae65
- https://git.kernel.org/stable/c/7bbf02b63961fc1768c9c654392c11f2077d4c59
- https://git.kernel.org/stable/c/8320c77e67382d5d55d77043a5f60a867d408a2b
- https://git.kernel.org/stable/c/8d202515baea4e2e3be448d1590099af28f2346d