{"id":"CVE-2026-98660","kind":"vulnerability","aliases":["CVE-2026-98660"],"related":[],"title":"Linux kernel: BMP280 sensor driver reads past a sampling table","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup\n\nThe sampling frequency tables store each frequency as an integer part and\na fractional part in micro units. num_sampling_freq_avail is initialized\nto the number of flattened integer elements because read_avail() returns\nthe table as a flat array.\n\nbmp280_write_sampling_frequency(), however, indexes the same table as a\ntwo-dimensional array and uses num_sampling_freq_avail as the number of\nrows. Convert the flattened element count back to the number of rows\nbefore iterating over the table.","summary":"The Linux kernel IIO driver for the Bosch BMP280 pressure sensor treats a flattened frequency table as two-dimensional when setting the sampling frequency, so the loop can index past the end of the table. The sources do not state what an attacker can do with this beyond an out-of-bounds read.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iio-sensors","infrastructure","kernel","linux"],"not_affected_if":["driver-not-loaded","no-bmp280-sensor"],"how_to_check":"- Check the kernel version with `uname -r` and compare it to the kernel release that contains the upstream fix.\n- Check whether the driver is loaded with `lsmod | grep bmp280`; if it is absent, the flaw is not reachable on that machine.","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing the bmp280 sampling frequency lookup; the exact version is unknown from the sources.","status":"open","published_at":"2026-10-18T16:17:19+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:32+00:00","updated_at":"2026-10-25T05:19:32+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:19:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing the bmp280 sampling frequency lookup; the exact version is unknown from the sources.","reach":"local","title":"Linux kernel: BMP280 sensor driver reads past a sampling table","impact":"low","summary":"The Linux kernel IIO driver for the Bosch BMP280 pressure sensor treats a flattened frequency table as two-dimensional when setting the sampling frequency, so the loop can index past the end of the table. The sources do not state what an attacker can do with this beyond an out-of-bounds read.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","embedded","iio-sensors"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources describe an out-of-bounds access only","analyst_note":"Check the NVD entry and the linked kernel.org commit to confirm affected versions and whether the out-of-bounds access can be triggered by an unprivileged user.","how_to_check":"- Check the kernel version with `uname -r` and compare it to the kernel release that contains the upstream fix.\n- Check whether the driver is loaded with `lsmod | grep bmp280`; if it is absent, the flaw is not reachable on that machine.","needs_analyst":true,"not_affected_if":["no-bmp280-sensor","driver-not-loaded"],"who_is_affected":"Only systems running a Linux kernel with the iio bmp280 pressure driver loaded, typically embedded or sensor-equipped hardware where that sensor is attached. Desktop and server systems without this sensor driver in use are unlikely to be affected. The sources do not say which kernel versions are vulnerable.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":3430,"output_tokens":635,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98660':13A,16A 'access':97C 'array':142C,157C 'attack':67B 'avail':123C,135C,163C 'back':174C 'beyond':72B 'bmp280':3A,32B,91C,143C 'bosch':31B 'bound':77B,96C 'convert':169C 'count':173C 'cve':11A,14A 'dimension':43B,156C 'driver':5A,28B 'element':132C,172C 'embed':17B 'end':56B 'fix':92C 'flat':141C 'flatten':37B,130C,171C 'follow':84C 'fraction':115C 'freq':122C,162C 'frequenc':38B,48B,100C,104C,108C,146C 'howev':147C 'iio':19B,27B,89C 'iio-sensor':18B 'index':53B,148C 'infrastructur':21B 'initi':125C 'integ':111C,131C 'iter':181C 'kernel':2A,22B,26B,82C 'linux':1A,23B,25B,81C 'lookup':101C 'loop':51B 'micro':118C 'num':120C,160C 'number':128C,166C,177C 'out-of-bound':74B,93C 'part':112C,116C 'past':7A,54B 'pressur':33B,90C 'read':6A,78B,134C 'resolv':88C 'return':136C 'row':168C,179C 'sampl':9A,47B,99C,103C,121C,145C,161C 'sensor':4A,20B,34B 'set':45B 'sourc':61B 'state':64B 'store':106C 'tabl':10A,39B,59B,105C,138C,151C,184C 'treat':35B 'two':42B,155C 'two-dimension':41B,154C 'unit':119C 'use':159C 'vulner':85C 'write':144C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the iio bmp280 pressure driver loaded, typically embedded or sensor-equipped hardware where that sensor is attached. Desktop and server systems without this sensor driver in use are unlikely to be affected. The sources do not say which kernel versions are vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98660","severity":null,"published_at":"2026-10-18T16:17:19+00:00","modified_at":"2026-10-21T13:21:35+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}