CVE-2024-26702

What it actually does

Missing boundary check on value read from RM3100_REG_TMRC allows out-of-bounds access into the rm3100_samp_rates array inside rm3100_common_probe when hardware returns invalid data.

Why it matters to the business

Kernel crashes on systems using the RM3100 magnetometer can cause unexpected downtime, loss of sensor data, and require manual recovery or reboot.

How an attack unfolds

An attacker or faulty hardware supplies an out-of-range TMRC register value during device probe; the driver indexes the sample-rate array without validation, triggering an out-of-bounds read and kernel panic.

How to fix it

Update the Linux kernel to a version containing commit 7200170e88e3ec54d9e9c63f07514c3cead11481 which adds the required boundary check before indexing rm3100_samp_rates.

How to confirm the fix worked

Inspect the rm3100_common_probe function for the added range check on the TMRC value, or boot a system with deliberately invalid register responses and confirm no crash occurs.

Typical attack path

1. Gain ability to influence or induce hardware faults on RM3100 sensor bus
2. Trigger device probe or re-initialization
3. Return crafted or erroneous value from RM3100_REG_TMRC
4. Driver performs unchecked array access leading to crash

How to detect it

Search kernel logs and crash dumps for references to rm3100_common_probe and rm3100_samp_rates around the time of oops or panic events.

• rm3100_common_probe
• rm3100_samp_rates
• RM3100_REG_TMRC

What your security team should do

• Apply the referenced kernel fix on all systems exposing the RM3100 driver
• Add kernel oops monitoring for rm3100 symbols
• Validate sensor hardware health as part of device onboarding