CVE-2026-64495

In the Linux kernel, the following vulnerability has been resolved:

iio: gyro: bmg160: bail out when bandwidth/filter is not in table

bmg160getfilter() walks bmg160sampfreqtable[] looking for the entry matching the bwbits value read from the chip:

for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) {
    if (bmg160_samp_freq_table[i].bw_bits == bw_bits)
        break;
}
*val = bmg160_samp_freq_table[i].filter;

If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160setfilter() has the same shape, driven by 'val' instead of bw_bits.

smatch flags both:

drivers/iio/gyro/bmg160core.c:204 bmg160getfilter() error: buffer overflow 'bmg160sampfreqtable' 7 <= 7 drivers/iio/gyro/bmg160core.c:222 bmg160setfilter() error: buffer overflow 'bmg160sampfreqtable' 7 <= 7

Return -EINVAL when no entry matches.

The setfilter() path is reachable from userspace via the sysfs inanglvelfilterlowpass3dbfrequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160sampfreqtable[].filter.