---
id: "CVE-2026-98660"
kind: "vulnerability"
aliases: ["CVE-2026-98660"]
title: "Linux kernel: BMP280 sensor driver reads past a sampling table"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "iio-sensors", "infrastructure", "kernel", "linux"]
not_affected_if: ["driver-not-loaded", "no-bmp280-sensor"]
published_at: "2026-10-18T16:17:19+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:19:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98660", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: BMP280 sensor driver reads past a sampling table

The Linux kernel IIO driver for the Bosch BMP280 pressure sensor treats a flattened frequency table as two-dimensional when setting the sampling frequency, so the loop can index past the end of the table. The sources do not state what an attacker can do with this beyond an out-of-bounds read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the kernel version with `uname -r` and compare it to the kernel release that contains the upstream fix.
- Check whether the driver is loaded with `lsmod | grep bmp280`; if it is absent, the flaw is not reachable on that machine.

## Fix

- Update the Linux kernel to a release that includes the upstream commit fixing the bmp280 sampling frequency lookup; the exact version is unknown from the sources.

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98660

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup

The sampling frequency tables store each frequency as an integer part and
a fractional part in micro units. num_sampling_freq_avail is initialized
to the number of flattened integer elements because read_avail() returns
the table as a flat array.

bmp280_write_sampling_frequency(), however, indexes the same table as a
two-dimensional array and uses num_sampling_freq_avail as the number of
rows. Convert the flattened element count back to the number of rows
before iterating over the table.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_