Live › vulnerability › CVE-2026-98660
Go to dashboardThe Linux kernel IIO driver for the Bosch BMP280 pressure sensor treats a flattened frequency table as two-dimensional when setting the sampling frequency, so the loop can index past the end of the table. The sources do not state what an attacker can do with this beyond an out-of-bounds read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running a Linux kernel with the iio bmp280 pressure driver loaded, typically embedded or sensor-equipped hardware where that sensor is attached. Desktop and server systems without this sensor driver in use are unlikely to be affected. The sources do not say which kernel versions are vulnerable.
No product ranges from the sources yet.
uname -r and compare it to the kernel release that contains the upstream fix.lsmod | grep bmp280; if it is absent, the flaw is not reachable on that machine.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
The sampling frequency tables store each frequency as an integer part and a fractional part in micro units. num_sampling_freq_avail is initialized to the number of flattened integer elements because read_avail() returns the table as a flat array.
bmp280_write_sampling_frequency(), however, indexes the same table as a two-dimensional array and uses num_sampling_freq_avail as the number of rows. Convert the flattened element count back to the number of rows before iterating over the table.
This page as .md · .json · in your agent: get_signal("CVE-2026-98660")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.