CVE-2026-31764
published 2026-05-01CVE-2026-31764: In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only The…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.12%
2.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only
The st_lsm6dsx_hwfifo_odr_store() function, which is called when userspace
writes the buffer sampling frequency sysfs attribute, calls
st_lsm6dsx_check_odr(), which accesses the odr_table array at index
`sensor->id`; since this array is only 2 entries long, an access for any
sensor type other than accelerometer or gyroscope is an out-of-bounds
access.
The motivation for being able to set a buffer frequency different from the
sensor sampling frequency is to support use cases that need accurate event
detection (which requires a high sampling frequency) while retrieving
sensor data at low frequency. Since all the supported event types are
generated from acceleration data only, do not create the buffer sampling
frequency attribute for sensor types other than the accelerometer.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 6b648a36c200dfd3e776e657a4c8a8ce63fb52d3 < 3225a81e8d264442b14c7c1bc965ebafa3c0ee01 | 3225a81e8d264442b14c7c1bc965ebafa3c0ee01 |
| linux | linux | >= 6b648a36c200dfd3e776e657a4c8a8ce63fb52d3 < 679c04c10d65d32a3f269e696b22912ff0a001b9 | 679c04c10d65d32a3f269e696b22912ff0a001b9 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.19 < 6.19.12 | 6.19.12 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only
vendor_redhat·2026-05-01
CVE-2026-31764 CWE-125 kernel: iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only
kernel: iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only
A flaw was found in the Linux kernel's `st_lsm6dsx` Industrial I/O (IIO) Inertial Measurement Unit (IMU) driver. A local user can trigger an out-of-bounds access by writing to the buffer sampling frequency sysfs attribute. This occurs when the `st_lsm6dsx_check_odr()` function attempts to access an array with an index derived from an unsupported sensor ID, leading to memory corruption. The most significant impact of this flaw is a denial of service (DoS), which could lead to system instability.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Ent
GHSA
GHSA-f6pj-wrqm-mccq: In the Linux kernel, the following vulnerability has been resolved:
iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only
The s
ghsa_unreviewed·2026-05-01
CVE-2026-31764 GHSA-f6pj-wrqm-mccq: In the Linux kernel, the following vulnerability has been resolved:
iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only
The s
In the Linux kernel, the following vulnerability has been resolved:
iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only
The st_lsm6dsx_hwfifo_odr_store() function, which is called when userspace
writes the buffer sampling frequency sysfs attribute, calls
st_lsm6dsx_check_odr(), which accesses the odr_table array at index
`sensor->id`; since this array is only 2 entries long, an access for any
sensor type other than accelerometer or gyroscope is an out-of-bounds
access.
The motivation for being able to set a buffer frequency different from the
sensor sampling frequency is to support use cases that need accurate event
detection (which requires a high sampling frequency) while retrieving
sensor data at low frequency. Since all the supported event types are
generated
No detection rules found.
No public exploits indexed.
2026-05-01
Published