CVE-2026-98660 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
The sampling frequency tables store each frequency as an integer part and a fractional part in micro units. num_sampling_freq_avail is initialized to the number of flattened integer elements because read_avail() returns the table as a flat array.
bmp280_write_sampling_frequency(), however, indexes the same table as a two-dimensional array and uses num_sampling_freq_avail as the number of rows. Convert the flattened element count back to the number of rows before iterating over the table.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in the Linux kernel's Industrial I/O subsystem specifically affects the BMP280 pressure sensor driver, representing a critical memory safety issue rooted in improper array indexing logic. The core technical flaw arises from a mismatch between how sampling frequency data is stored and how it is accessed during write operations. Internally, the driver maintains tables where each entry consists of an integer part and a fractional part, effectively forming a two-dimensional structure when viewed logically as pairs of values. However, for efficiency in certain read operations handled by the read_avail function, this data is flattened into a single one-dimensional array. The variable num_sampling_freq_avail was incorrectly initialized to represent the total count of individual elements within this flat array rather than the number of actual frequency entries or rows.
This initialization error leads directly to an out-of-bounds memory access when the bmp280_write_sampling_frequency function is invoked. Because the write operation treats the data structure as a two-dimensional array, it iterates based on row indices. By using the total element count as the upper bound for iteration instead of the correct number of rows, the loop exceeds the allocated bounds of the underlying memory buffer. This results in reading or writing to memory locations that are not part of the intended sampling frequency table, which constitutes a classic out-of-bounds read/write vulnerability. Such an error can lead to data corruption, kernel panics due to invalid memory access, or potentially allow for arbitrary code execution if an attacker can control the input values and leverage the overwritten memory contents.
From a security taxonomy perspective, this flaw aligns with CWE-125, which describes Out-of-bounds Read, as well as CWE-787, which covers Out-of-bounds Write, depending on whether the specific access results in reading stale data or corrupting adjacent kernel structures. In terms of attack vectors and tactics, this vulnerability could be exploited within the context of ATT&CK technique T1059, Command and Scripting Interpreter, if an attacker can trigger the write function through a local user space application to escalate privileges by overwriting critical kernel pointers or control flow data. The impact is significant because it compromises the integrity and stability of the operating system at the driver level, which often runs with high privileges in the kernel space.
Mitigation for this vulnerability requires applying the specific patch that corrects the calculation logic within the bmp280_write_sampling_frequency function. Developers must ensure that when iterating over a flattened array to simulate two-dimensional access, the loop bounds are calculated by dividing the total element count by the number of columns or components per entry, thereby accurately reflecting the number of rows. System administrators should update their Linux kernels to versions where this fix is included. Furthermore, rigorous code review processes and static analysis tools that detect index calculation errors in multi-dimensional array simulations can help prevent similar logical flaws in other drivers within the Industrial I/O subsystem before they reach production environments.