---
id: "CVE-2026-98835"
kind: "vulnerability"
aliases: ["CVE-2026-98835"]
title: "Linux kernel: off-by-one array bound check in kionix-kx022a accelerometer driver"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "iio-sensors", "infrastructure", "linux-kernel"]
not_affected_if: ["driver-not-loaded", "no-kx022a-hardware"]
published_at: "2026-10-18T16:17:37+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:13:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98835", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Linux kernel: off-by-one array bound check in kionix-kx022a accelerometer driver

The kionix-kx022a industrial accelerometer driver in the Linux kernel accepts an index equal to the array size, reading one element past the end of an array. The sources do not describe an attacker-controlled path or a demonstrated impact beyond the out-of-bounds read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and check whether the kernel build includes the kionix-kx022a IIO driver (`grep -i kx022a /boot/config-$(uname -r)`)
- unknown for whether the driver is loaded on a given host

## Fix

- Install a Linux kernel build that includes the upstream fix for the kionix-kx022a array boundary check; the sources do not name a fixed version
- unknown for the exact patched kernel versions

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98835

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

iio: accel: kionix-kx022a: Fix array boundary check

The driver performs a sanity check for an array size, when converting a
register value to an array index. The check incorrectly accepts the
sizeof(array) as a last index, when last valid index should be
sizeof(array) - 1.

Fix the check by bailing out when index >= sizeof(array).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_