All vulnerabilities
CVE-2026-98660

Linux: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in05ef1af381a0f4556c7e3c0dc6bc2428d16c707eAlso 9db6684fab228edd3b8861a172ccbce3236f027a, 4fd5a61e61d6899cbd45728a5fceba49a53c222d and 2 moreCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 05ef1af381a0f4556c7e3c0dc6bc2428d16c707eLinuxCVE List
  • 9db6684fab228edd3b8861a172ccbce3236f027aLinuxCVE List
  • 4fd5a61e61d6899cbd45728a5fceba49a53c222dLinuxCVE List
  • 7dbb518f3328ebd9d5c6e970b4befad6deb5c7f1LinuxCVE List
  • 56c423b233b214182c58c99861899327b45b0d6cLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup

The sampling frequency tables store each frequency as an integer part and a fractional part in micro units. num_sampling_freq_avail is initialized to the number of flattened integer elements because read_avail() returns the table as a flat array.

bmp280_write_sampling_frequency(), however, indexes the same table as a two-dimensional array and uses num_sampling_freq_avail as the number of rows. Convert the flattened element count back to the number of rows before iterating over the table.

Text from CVE List

Affected versions 12

  • Linuxaffected: 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 before 05ef1af381a0f4556c7e3c0dc6bc2428d16c707eCVE List
  • Linuxaffected: 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 before 9db6684fab228edd3b8861a172ccbce3236f027aCVE List
  • Linuxaffected: 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 before 4fd5a61e61d6899cbd45728a5fceba49a53c222dCVE List
  • Linuxaffected: 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 before 7dbb518f3328ebd9d5c6e970b4befad6deb5c7f1CVE List
  • Linuxaffected: 10b40ffba2f95cdeed47b731c5ad5ecc73e140e8 before 56c423b233b214182c58c99861899327b45b0d6cCVE List
  • Linuxaffected: 6.1CVE List
  • Linuxunaffected: all versions before 6.1CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5