Cloudanix VulnDB

CVE-2026-98835

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A small programming mistake in a sensor driver can let specially crafted input reach beyond its intended memory area, which might crash the system or allow an attacker who already has access to gain more control.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Off-by-one error in array bounds check allows register-derived index equal to sizeof(array) to be treated as valid, resulting in out-of-bounds memory access when the driver converts the value to an array index.

Why it matters to the business

Systems using the affected accelerometer driver face risk of kernel instability, crashes, or potential local privilege escalation; low exploitability keeps immediate operational disruption low but requires prompt patching on any Linux kernel with the driver enabled.

How an attack unfolds

An attacker with local access supplies a crafted register value that passes the flawed check (index == sizeof(array)), causing the driver to read or write past the end of the internal array and potentially corrupt adjacent kernel memory.

How to fix it

Apply the upstream fix that changes the boundary check to reject any index >= sizeof(array); rebuild and deploy the patched kernel; disable the kionix-kx022a driver if the hardware is not required.

How to confirm the fix worked

Inspect the driver source for the corrected condition (index >= sizeof(array)) and confirm the updated kernel is running via uname or module signature verification.

Typical attack path

  1. Obtain local code execution or shell on target system
  2. Load or trigger the kionix-kx022a IIO driver
  3. Manipulate sensor register value to equal array size
  4. Trigger index conversion that bypasses the off-by-one check
  5. Perform out-of-bounds read/write to achieve crash or escalation

How to detect it

Review kernel logs for oops or panic messages referencing kionix-kx022a or array index errors near IIO accelerometer code paths; examine audit logs for unusual access to /dev/iio* devices.

What your security team should do

  • Patch kernels within standard maintenance windows given low EPSS and no KEV listing
  • Audit systems for presence of kionix-kx022a driver and prioritize those exposing the IIO interface
  • Monitor upstream stable branches for backported fixes
  • Consider driver blacklisting on systems without the sensor hardware

The record

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeof(array) as a last index, when last valid index should be sizeof(array) - 1. Fix the check by bailing out when index >= sizeof(array).

Affected packages

Ecosystem Package Introduced Fixed