Cloudanix VulnDB

CVE-2026-98660

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding error in the way some pressure sensors calculate data rates could let the system access memory it shouldn't, risking crashes on affected devices.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect use of a flattened array element count as row count when indexing a two-dimensional sampling frequency table causes out-of-bounds access in bmp280_write_sampling_frequency.

Why it matters to the business

Systems using BMP280 pressure sensors may experience kernel crashes, memory corruption, or denial of service when sampling frequency is configured, affecting embedded Linux devices and IoT platforms.

How an attack unfolds

An attacker with local access writes an out-of-range sampling frequency value, triggering the write handler to index beyond the table bounds and corrupt adjacent kernel memory.

How to fix it

Update the Linux kernel to a version containing the fix for the bmp280 sampling frequency lookup indexing error.

How to confirm the fix worked

Verify kernel source contains the corrected num_sampling_freq_avail row conversion logic and test sampling frequency configuration on BMP280 hardware.

Typical attack path

  1. Obtain local shell or userland execution on affected device
  2. Open IIO device interface for bmp280
  3. Invoke write on sampling_frequency attribute with crafted value
  4. Trigger out-of-bounds table access and memory corruption

How to detect it

Review kernel logs for oops or BUG entries referencing bmp280_write_sampling_frequency or sampling frequency tables; inspect IIO sysfs writes around the time of any crash.

What your security team should do

  • Prioritize kernel updates on all devices exposing IIO pressure sensors
  • Restrict unprivileged local access to IIO sysfs interfaces until patched
  • Monitor for kernel oops or panic logs related to bmp280 driver

The record

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup The sampling frequency tables store each frequency as an integer part and a fractional part in micro units. num_sampling_freq_avail is initialized to the number of flattened integer elements because read_avail() returns the table as a flat array. bmp280_write_sampling_frequency(), however, indexes the same table as a two-dimensional array and uses num_sampling_freq_avail as the number of rows. Convert the flattened element count back to the number of rows before iterating over the table.

Affected packages

Ecosystem Package Introduced Fixed