{"id":"CVE-2026-98835","kind":"vulnerability","aliases":["CVE-2026-98835"],"related":[],"title":"Linux kernel: off-by-one array bound check in kionix-kx022a accelerometer driver","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: kionix-kx022a: Fix array boundary check\n\nThe driver performs a sanity check for an array size, when converting a\nregister value to an array index. The check incorrectly accepts the\nsizeof(array) as a last index, when last valid index should be\nsizeof(array) - 1.\n\nFix the check by bailing out when index >= sizeof(array).","summary":"The kionix-kx022a industrial accelerometer driver in the Linux kernel accepts an index equal to the array size, reading one element past the end of an array. The sources do not describe an attacker-controlled path or a demonstrated impact beyond the out-of-bounds read.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iio-sensors","infrastructure","linux-kernel"],"not_affected_if":["driver-not-loaded","no-kx022a-hardware"],"how_to_check":"- Run `uname -r` and check whether the kernel build includes the kionix-kx022a IIO driver (`grep -i kx022a /boot/config-$(uname -r)`)\n- unknown for whether the driver is loaded on a given host","fix":"- Install a Linux kernel build that includes the upstream fix for the kionix-kx022a array boundary check; the sources do not name a fixed version\n- unknown for the exact patched kernel versions","status":"open","published_at":"2026-10-18T16:17:37+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:17+00:00","updated_at":"2026-10-25T05:13:17+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:13:17Z","model":"claude-haiku-5-5","output":{"fix":"- Install a Linux kernel build that includes the upstream fix for the kionix-kx022a array boundary check; the sources do not name a fixed version\n- unknown for the exact patched kernel versions","reach":"local","title":"Linux kernel: off-by-one array bound check in kionix-kx022a accelerometer driver","impact":"low","summary":"The kionix-kx022a industrial accelerometer driver in the Linux kernel accepts an index equal to the array size, reading one element past the end of an array. The sources do not describe an attacker-controlled path or a demonstrated impact beyond the out-of-bounds read.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","embedded","iio-sensors"],"confidence":0.4,"needs_auth":"unknown","worst_case":"out-of-bounds read of one array element in kernel driver","analyst_note":"","how_to_check":"- Run `uname -r` and check whether the kernel build includes the kionix-kx022a IIO driver (`grep -i kx022a /boot/config-$(uname -r)`)\n- unknown for whether the driver is loaded on a given host","needs_analyst":false,"not_affected_if":["no-kx022a-hardware","driver-not-loaded"],"who_is_affected":"Only systems running a Linux kernel with the kionix-kx022a accelerometer driver compiled in or loaded, typically embedded or hardware devices with that sensor. General servers and cloud hosts without that hardware driver are unlikely to be exposed. The sources do not say how the register value reaches the driver.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000625,"input_tokens":3356,"output_tokens":579,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-98835':18A,21A '1':136C 'accel':90C 'acceleromet':14A,35B 'accept':41B,120C 'array':7A,47B,57B,95C,106C,115C,123C,135C,146C 'attack':65B 'attacker-control':64B 'bail':141C 'beyond':72B 'bound':8A,77B 'boundari':96C 'check':9A,97C,103C,118C,139C 'control':66B 'convert':109C 'cve':16A,19A 'demonstr':70B 'describ':62B 'driver':15A,36B,99C 'element':51B 'embed':22B 'end':54B 'equal':44B 'fix':94C,137C 'follow':84C 'iio':24B,89C 'iio-sensor':23B 'impact':71B 'incorrect':119C 'index':43B,116C,127C,131C,144C 'industri':34B 'infrastructur':26B 'kernel':2A,29B,40B,82C 'kionix':12A,32B,92C 'kionix-kx022a':11A,31B,91C 'kx022a':13A,33B,93C 'last':126C,129C 'linux':1A,28B,39B,81C 'linux-kernel':27B 'off-by-on':3A 'one':6A,50B 'out-of-bound':74B 'past':52B 'path':67B 'perform':100C 'read':49B,78B 'regist':111C 'resolv':88C 'saniti':102C 'sensor':25B 'size':48B,107C 'sizeof':122C,134C,145C 'sourc':59B 'valid':130C 'valu':112C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a Linux kernel with the kionix-kx022a accelerometer driver compiled in or loaded, typically embedded or hardware devices with that sensor. General servers and cloud hosts without that hardware driver are unlikely to be exposed. The sources do not say how the register value reaches the driver.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98835","severity":null,"published_at":"2026-10-18T16:17:37+00:00","modified_at":"2026-10-21T13:21:48+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}