{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.96-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.4-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  iio: gyro: bmg160: bail out when bandwidth/filter is not in table  bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip:  \tfor (i = 0; i \u003c ARRAY_SIZE(bmg160_samp_freq_table); ++i) { \t\tif (bmg160_samp_freq_table[i].bw_bits == bw_bits) \t\t\tbreak; \t} \t*val = bmg160_samp_freq_table[i].filter;  If no entry matches, i ends up equal to the array size and the next line reads one slot past the end. bmg160_set_filter() has the same shape, driven by 'val' instead of bw_bits.  smatch flags both:    drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error:   buffer overflow 'bmg160_samp_freq_table' 7 \u003c= 7   drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error:   buffer overflow 'bmg160_samp_freq_table' 7 \u003c= 7  Return -EINVAL when no entry matches.  The set_filter() path is reachable from userspace via the sysfs in_anglvel_filter_low_pass_3db_frequency interface, so userspace can trivially trigger the out-of-bounds read with a value that is not in bmg160_samp_freq_table[].filter.",
  "id": "DEBIAN-CVE-2026-64495",
  "modified": "2026-09-14T16:47:42.411205015Z",
  "published": "2026-07-25T10:17:35.360Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64495"
    }
  ],
  "upstream": [
    "CVE-2026-64495"
  ]
}