CVE-2026-64495

In the Linux kernel, the following vulnerability has been resolved:

iio: gyro: bmg160: bail out when bandwidth/filter is not in table

bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry

matching the bw_bits value read from the chip:

for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) {

if (bmg160_samp_freq_table[i].bw_bits == bw_bits)

break;

}

*val = bmg160_samp_freq_table[i].filter;

If no entry matches, i ends up equal to the array size and the next line

reads one slot past the end. bmg160_set_filter() has the same shape, driven

by 'val' instead of bw_bits.

smatch flags both:

drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error:

buffer overflow 'bmg160_samp_freq_table' 7 <= 7

drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error:

buffer overflow 'bmg160_samp_freq_table' 7 <= 7

Return -EINVAL when no entry matches.

The set_filter() path is reachable from userspace via the sysfs

in_anglvel_filter_low_pass_3db_frequency interface, so userspace can

trivially trigger the out-of-bounds read with a value that is not in

bmg160_samp_freq_table[].filter.