Executive brief
A bug was identified in the Linux kernel driver for the SCD30 carbon dioxide sensor. The issue involves a technical error in how the software processes numerical data from the sensor, which could lead to incorrect readings or unexpected behavior in systems relying on this hardware. This has been resolved in recent kernel updates.
Technical details
A sign-extension vulnerability was identified in `drivers/iio/chemical/scd30_core.c` within the `scd30_float_to_fp` function. The root cause was an incorrect bitwise operation where a 32-bit float value was ANDed with `~BIT(31)`, resulting in a 64-bit mask (0xFFFFFFFF7FFFFFFF) on 64-bit architectures due to sign extension. This mask corrupted the exponent bits of the sensor data. The fix involves refactoring the initialization using `FIELD_GET()` from `linux/bitfield.h` to properly isolate the mantissa, exponent, and sign bits. The vulnerability affects Linux kernel versions starting from 5.9.
Affected products
- Linux Linux Kernel 5.9 to 6.10.y
Timeline
- 2026-05-26: disclosed: Patch submitted by Maxwell Doose
- 2026-07-24: patched: Committed to stable kernel tree
- 2026-07-25: advisory: CVE-2026-64497 published
References
- https://git.kernel.org/stable/c/0ccff849bde90973e6c13a666f6ceab5c55b30d4
- https://git.kernel.org/stable/c/1821bcacd8ac5b214c53be16cbb8172bf193f0b6
- https://git.kernel.org/stable/c/40bb0fdb37f441c9c9f52bf58bbd8a0ca3cc9598
- https://git.kernel.org/stable/c/60d877910a43c305b5165131b258a17b1d772d57
- https://git.kernel.org/stable/c/82accdd57404399eddf3d56fd9beda7c61307388
- https://git.kernel.org/stable/c/8d4a46e971cf846bda98b20d4cabfa21c1276e5f
- https://git.kernel.org/stable/c/b131f0011dfef72350f4e3f11df94dc3e6b46065