CVE-2026-64495

What it actually does

This is an out-of-bounds read in the Linux kernel BMG160 gyroscope Industrial I/O driver. The vulnerable code searches a fixed sampling-frequency/filter table and, when no matching entry is found, continues to read one element past the end of the array instead of returning an error. The userspace-accessible sysfs attribute `in_anglvel_filter_low_pass_3db_frequency` can trigger the vulnerable `set_filter` path by supplying a filter value that is not present in the driver's table. The likely impact is kernel memory safety violation, driver misbehavior, and potential local denial of service if the invalid read causes a kernel warning, oops, or panic; it should not be treated as remotely exploitable based on the available information.

Why it matters to the business

Systems using Linux kernels with the vulnerable BMG160 gyroscope driver may be susceptible to local disruption if an attacker or untrusted local process can access the relevant Industrial I/O sysfs interface. The operational risk is highest for embedded, mobile, IoT, robotics, sensor, or hardware-appliance deployments that include Bosch BMG160-compatible gyroscope hardware or ship kernels with this driver enabled. The vulnerability is not currently in CISA KEV, has very low EPSS, and has no known public exploit maturity, so remediation should be prioritized based on exposure of the driver and local user access rather than treated as an internet-wide emergency.

How an attack unfolds

An attacker first needs local access to a Linux system where the BMG160 gyroscope driver is present, loaded, and bound to a device exposing the Industrial I/O sysfs attributes. The attacker locates the corresponding `/sys/bus/iio/devices/iio:device*` entry and writes an unsupported value to `in_anglvel_filter_low_pass_3db_frequency`. The driver attempts to map that value to an entry in `bmg160_samp_freq_table`; because the value is not present, the loop exits with the index equal to the table length and the next access reads beyond the end of the table. Depending on kernel build options, adjacent memory contents, hardening, and panic-on-oops settings, this may produce no visible impact, an error path, a KASAN finding, a kernel warning/oops, driver instability, or system crash. There is no indication from the supplied data that remote exploitation, ransomware use, or active exploitation by named threat actors is occurring.

How to fix it

Apply a Linux kernel update from the operating system or device vendor that includes the BMG160 driver fix returning `-EINVAL` when no matching bandwidth/filter table entry is found. No exact fixed package versions were provided, so track the relevant vendor advisories and kernel stable updates for the patch to `drivers/iio/gyro/bmg160_core.c`. Where immediate patching is not possible, reduce exposure by disabling or blacklisting the `bmg160` driver if the gyroscope is not required, removing access to affected hardware interfaces, restricting local shell/container access, and ensuring only trusted privileged users can write to IIO sysfs device attributes. Embedded vendors should backport the specific bounds-check fix into maintained kernel branches and rebuild affected firmware images.

How to confirm the fix worked

Confirm that the installed kernel or firmware contains the patched BMG160 driver logic that rejects unmatched filter or bandwidth values with `-EINVAL`. Validate exposure by checking whether BMG160 hardware is present, whether the `bmg160` driver is loaded, and whether `/sys/bus/iio/devices/iio:device*/in_anglvel_filter_low_pass_3db_frequency` exists. In a controlled test environment only, write an unsupported value to the attribute and verify that the operation fails cleanly without kernel warnings, KASAN findings, oops events, or crashes.

Typical attack path

1. Gain local code execution or shell access on a Linux system that includes the vulnerable BMG160 gyroscope driver.
2. Confirm the BMG160/IIO device is present by enumerating `/sys/bus/iio/devices/`, loaded kernel modules, or device-tree/ACPI bindings.
3. Identify the writable `in_anglvel_filter_low_pass_3db_frequency` sysfs attribute for the gyroscope device.
4. Write a filter frequency value that is not contained in the driver's valid `bmg160_samp_freq_table` entries.
5. Trigger the vulnerable table lookup in `bmg160_set_filter()`, causing a one-element out-of-bounds read.
6. Observe resulting behavior such as driver error, kernel warning, KASAN report, oops, or system instability.

How to detect it

To determine whether this was already triggered, review kernel logs, persistent journal logs, crash dumps, and audit telemetry for accesses to the BMG160 IIO sysfs attribute and for kernel memory-safety reports involving the BMG160 driver. Relevant sources include `dmesg`, `/var/log/kern.log`, `/var/log/messages`, `journalctl -k`, pstore/ramoops, kdump/vmcore records, auditd logs for writes under `/sys/bus/iio/devices/`, EDR process telemetry for shell or application writes to sysfs, and container runtime logs if containers are allowed to mount or write host sysfs. Look for KASAN or kernel oops messages referencing `bmg160_get_filter`, `bmg160_set_filter`, `bmg160_samp_freq_table`, or `drivers/iio/gyro/bmg160_core.c`, especially near writes to `in_anglvel_filter_low_pass_3db_frequency`. Since this is a local kernel-driver issue, network indicators are not expected unless exploitation is part of a larger intrusion chain.

• /sys/bus/iio/devices/iio:device*/in_anglvel_filter_low_pass_3db_frequency
• in_anglvel_filter_low_pass_3db_frequency
• bmg160_get_filter
• bmg160_set_filter
• bmg160_samp_freq_table
• drivers/iio/gyro/bmg160_core.c
• bmg160_core
• bmg160
• BUG: KASAN: global-out-of-bounds
• global-out-of-bounds in bmg160_set_filter
• global-out-of-bounds in bmg160_get_filter
• buffer overflow 'bmg160_samp_freq_table'
• iio: gyro: bmg160
• bmg160_samp_freq_table[]

What your security team should do

• Inventory Linux systems, embedded appliances, and device images that include the BMG160 gyroscope driver or expose IIO gyroscope sysfs attributes.
• Prioritize patching systems where the driver is loaded, BMG160-compatible hardware is present, and local users, containers, applications, or third-party code can write to sysfs device attributes.
• If the hardware is unused, disable or blacklist the `bmg160` driver as a near-term mitigation.
• Monitor vendor kernel advisories and stable kernel releases for the backported fix because no exact fixed versions were supplied in the input.
• Enable kernel hardening and observability where feasible, including KASAN in test builds, kernel oops collection, audit logging for sysfs writes, and alerting on unexpected writes to IIO device attributes.
• Treat detections as local-posture or insider-risk signals unless paired with evidence of broader compromise, because the described vulnerability requires local interaction with a device sysfs interface.