CVE-2026-64495 — CVE & Security Advisory Radar

🎯 CVE-2026-64495 LOW 3.1 🔥 EPSS 20% 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2026-64495 | In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip: for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) { if (bmg160_samp_freq_table[i].bw_bits == bw_bits) break; } *val = bmg160_samp_freq_table[i].filter; If no entry matches, i ends up equal t

In the Linux kernel, the following vulnerability has been resolved:

iio: gyro: bmg160: bail out when bandwidth/filter is not in table

bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry
matching the bw_bits value read from the chip:

for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) {
if (bmg160_samp_freq_table[i].bw_bits == bw_bits)
break;
}
*val = bmg160_samp_freq_table[i].filter;

If no entry matches, i ends up equal to the array size and the next line
reads one slot past the end. bmg160_set_filter() has the same shape, driven
by 'val' instead of bw_bits.

smatch flags both:

drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error:
buffer overflow 'bmg160_samp_freq_table' 7

Klassifikation & Betroffenheit:

Linux Linux patch: 6.18.39Linux 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc <8320c77e67382d5d55d77043a5f60a867d408a2bLinux 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc <77e56ebb1786f4296afd5fa46975a989b285ae65Linux 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc <029481cddb98697716f4bf3021d035eaf2ca0e1fLinux patch: 5.10.261Linux patch: 7.1.4Linux 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc <7bbf02b63961fc1768c9c654392c11f2077d4c59Linux 22b46c45fb9be8ec1fcb4d9b74810e6a20ff67cc <8d202515baea4e2e3be448d1590099af28f2346d

Improper Restriction of Operations within the Bounds of a Memory Buffer 🎯 High

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

🛡️ Empfohlene Mitigation: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow prot…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-10 · Buffer Overflow via Environment Variable… (High) CAPEC-14 · Client-side Injection-induced Buffer Ove… (High) CAPEC-24 · Filter Failure through Buffer Overflow (High) CAPEC-42 · MIME Conversion (High) CAPEC-44 · Overflow Binary Resource File (Very High) CAPEC-45 · Buffer Overflow via Symbolic Links (High) CAPEC-100 · Overflow Buffers (Very High) CAPEC-123 · Buffer Manipulation (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2021-47476 4.6 CVE-2024-24857 4.6 CVE-2024-24858 4.6 CVE-2024-24859 4.6 CVE-2024-24860 4.6

🩹 Patch verfügbar (OSV):

🩹 Kernel ≥ 5.10.261 🩹 Kernel ≥ 5.15.212 🩹 Kernel ≥ 6.1.178 🩹 Kernel ≥ 6.6.145 🩹 Kernel ≥ 6.12.96 🩹 Kernel ≥ 6.18.39

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 07/2026

Heute 08.09.

Veröffentlicht:25.07.2026

Aktualisiert:17.08.2026 05:17

Assigner (CNA):Linux

EUVD-ID:EUVD-2026-48839

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-119: Memory Corruption ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Kernel-Paket aktualisieren (apt upgrade linux-image / yum update kernel) und System neu starten.

Tier	2026-08-29	2026-09-06
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

3.1 LOW

🇪🇺 EUVD

EPSS

20%

CVE-2026-64495 💻 Lokal 🔓 Keine Authentifizierung nötig

Linux

CVE-2026-64495 | In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip: for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) { if (bmg160_samp_freq_table[i].bw_bits == bw_bits) break; } *val = bmg160_samp_freq_table[i].filter; If no entry matches, i ends up equal t

CWE-119: Memory Corruption ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Kernel-Paket aktualisieren (apt upgrade linux-image / yum update kernel) und System neu starten.

25.07.2026

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub