CVE-2026-31764

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31764", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.139Z", "datePublished": "2026-05-01T14:14:55.230Z", "dateUpdated": "2026-05-11T22:15:21.708Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:15:21.708Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only\n\nThe st_lsm6dsx_hwfifo_odr_store() function, which is called when userspace\nwrites the buffer sampling frequency sysfs attribute, calls\nst_lsm6dsx_check_odr(), which accesses the odr_table array at index\n`sensor->id`; since this array is only 2 entries long, an access for any\nsensor type other than accelerometer or gyroscope is an out-of-bounds\naccess.\n\nThe motivation for being able to set a buffer frequency different from the\nsensor sampling frequency is to support use cases that need accurate event\ndetection (which requires a high sampling frequency) while retrieving\nsensor data at low frequency. Since all the supported event types are\ngenerated from acceleration data only, do not create the buffer sampling\nfrequency attribute for sensor types other than the accelerometer."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"], "versions": [{"version": "6b648a36c200dfd3e776e657a4c8a8ce63fb52d3", "lessThan": "3225a81e8d264442b14c7c1bc965ebafa3c0ee01", "status": "affected", "versionType": "git"}, {"version": "6b648a36c200dfd3e776e657a4c8a8ce63fb52d3", "lessThan": "679c04c10d65d32a3f269e696b22912ff0a001b9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3225a81e8d264442b14c7c1bc965ebafa3c0ee01"}, {"url": "https://git.kernel.org/stable/c/679c04c10d65d32a3f269e696b22912ff0a001b9"}], "title": "iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3225a81e8d264442b14c7c1bc965ebafa3c0ee01", "status": "affected", "version": "6b648a36c200dfd3e776e657a4c8a8ce63fb52d3", "versionType": "git"}, {"lessThan": "679c04c10d65d32a3f269e696b22912ff0a001b9", "status": "affected", "version": "6b648a36c200dfd3e776e657a4c8a8ce63fb52d3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only\n\nThe st_lsm6dsx_hwfifo_odr_store() function, which is called when userspace\nwrites the buffer sampling frequency sysfs attribute, calls\nst_lsm6dsx_check_odr(), which accesses the odr_table array at index\n`sensor->id`; since this array is only 2 entries long, an access for any\nsensor type other than accelerometer or gyroscope is an out-of-bounds\naccess.\n\nThe motivation for being able to set a buffer frequency different from the\nsensor sampling frequency is to support use cases that need accurate event\ndetection (which requires a high sampling frequency) while retrieving\nsensor data at low frequency. Since all the supported event types are\ngenerated from acceleration data only, do not create the buffer sampling\nfrequency attribute for sensor types other than the accelerometer."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niio: imu: st_lsm6dsx: Establecer la frecuencia de muestreo del b\u00fafer solo para el aceler\u00f3metro\n\nLa funci\u00f3n st_lsm6dsx_hwfifo_odr_store(), que se llama cuando el espacio de usuario (userspace) escribe el atributo sysfs de frecuencia de muestreo del b\u00fafer, llama a st_lsm6dsx_check_odr(), que accede al array odr_table en el \u00edndice \u2019sensor -> id\u2019; dado que este array tiene solo 2 entradas de longitud, un acceso para cualquier tipo de sensor que no sea aceler\u00f3metro o giroscopio es un acceso fuera de l\u00edmites.\n\nLa motivaci\u00f3n para poder establecer una frecuencia de b\u00fafer diferente de la frecuencia de muestreo del sensor es para soportar casos de uso que necesitan detecci\u00f3n precisa de eventos (lo que requiere una alta frecuencia de muestreo) mientras se recuperan datos del sensor a baja frecuencia. Dado que todos los tipos de eventos soportados se generan solo a partir de datos de aceleraci\u00f3n, no cree el atributo de frecuencia de muestreo del b\u00fafer para tipos de sensor que no sean el aceler\u00f3metro."}], "id": "CVE-2026-31764", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-01T15:16:39.523", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3225a81e8d264442b14c7c1bc965ebafa3c0ee01"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/679c04c10d65d32a3f269e696b22912ff0a001b9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only", "id": "2464500", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464500"}, "csaw": false, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's `st_lsm6dsx` Industrial I/O (IIO) Inertial Measurement Unit (IMU) driver. A local user can trigger an out-of-bounds access by writing to the buffer sampling frequency sysfs attribute. This occurs when the `st_lsm6dsx_check_odr()` function attempts to access an array with an index derived from an unsupported sensor ID, leading to memory corruption. The most significant impact of this flaw is a denial of service (DoS), which could lead to system instability."], "name": "CVE-2026-31764", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31764\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31764\nhttps://lore.kernel.org/linux-cve-announce/2026050146-CVE-2026-31764-8607@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6b648a36c200dfd3e776e657a4c8a8ce63fb52d3,3225a81e8d264442b14c7c1bc965ebafa3c0ee01)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6b648a36c200dfd3e776e657a4c8a8ce63fb52d3,679c04c10d65d32a3f269e696b22912ff0a001b9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T17:00:10.791107+00:00", "updated": "2026-05-08T22:15:18.992451+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}